Question 1

A secondary administrator has been granted access to a BIG-IP device through itsManagement Interface, but is unable to access the Configuration Utility (WebUI).
What command can be run from the CLI to capture the network traffic on the management interface and troubleshoot the issue?
(Choose two.)

Accepted Answer

The BIG-IP has two distinct planes:
 Management-plane# handled entirely by the management interface (MGMT)
 Data-plane (TMM)# handles Self IPs, VLAN interfaces, and traffic processing
To capture traffic on the management interface, only the management-side NICs may be used:
 mgmt# Logical name for the management interface
 eth0# Physical Linux interface mapped to the management port on most BIG-IP platforms
Both of these correctly capture inbound/outbound WebUI (HTTPS/443) traffic on the management port.
Why the correct answers are A and B
* A. tcpdump -i eth0 -n port 443
 On BIG-IP appliances and VMs, the management port maps toeth0at the Linux OS level.
 Capturing on eth0 correctly shows HTTPS traffic to the WebUI.
* B. tcpdump -i mgmt -n port 443
 mgmtis the BIG-IP alias for the management interface.
 This is thepreferredand most explicit capture interface for management-plane packet captures.
Why the other options are incorrect:
* C. tcpdump -i 0.0
 Interface0.0is the TMM switch interface used for data-plane packet captures.
 Itdoes NOTcapture management-plane traffic.
* D. tcpdump -i tun0
 Used for tunnel interfaces (IPsec, VXLAN, etc.)
 Not related to management access.
* E. tcpdump -i management
 There isnointerface named management on BIG-IP.
 The correct names are mgmt or eth0.

Question 2

An organization is planning to upgrade a BIG-IP system from16.1.xto17.1.x.
For a successful upgrade, theService Check Datemust be equal to or newer than the License Check Date required for 17.1.x.
Which command will show the Service Check Date on the BIG-IP system being upgraded?

Accepted Answer

BIG-IP licensing information, including theService Check Date, is stored in the file:
/config/bigip.license
This file contains all license attributes downloaded from the F5 licensing server, including:
License key
Licensed modules
Useful life date
Service check date
TheService Check Datedetermines whether the system is eligible for upgrades to specific TMOS versions. When reviewing upgrade readiness, administrators
extract this value directly from the license file with:
grep "Service check date" /config/bigip.license
Why the other options are incorrect:
/config/bigip.confstores BIG-IP configuration objects, not license metadata.
/config/svc_chk_date.datisnota valid file in the licensing system; it does not contain license parameters.
/config/BigDB.datstores internal database values, not licensing attributes.

Certshared now are offering 100% pass ensure F5CAB1 dumps!
/exam/F5CAB1/ (42 Q&As)
Thus, only thebigip.licensefile contains the correct licensing information required for verifying upgrade eligibility.

Question 3

The BIG-IP Administrator needs to update access to the Configuration Utility to include the 172.28.31.0/24and172.28.65.0/24networks.
From the TMOS Shell (tmsh), which command should the BIG-IP Administrator use to complete this task?

Accepted Answer

Access to the BIG-IP Configuration Utility (TMUI) is controlled through the/sys httpd allowlist.
This list defines which IP addresses or subnets are allowed to connect to the management web interface.
To allow two new subnets—172.28.31.0/24and172.28.65.0/24—the administrator mustaddboth subnets to the existing list without removing current entries.
In tmsh, subnet entries must be specified innetwork/netmask format, for example: 172.28.31.0/255.255.255.0
The correct tmsh command to append these networks is:
modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
Why the other options are incorrect:
Option B:
IPs are listed without masks, which is invalid for subnet-based access control.
The system requiresnetwork/netmaskformat.
Option C:
The command uses permit instead of allow, which is not a valid attribute of /sys httpd.
The correct keyword must beallow.
Thus, onlyOption Acorrectly adds both permitted subnets in the proper tmsh format.

Question 4

The Port Lockdown feature prevents unwanted connection attempts to a Self IP.
Which three types of connection attempts are unaffected by Port Lockdown settings?

Accepted Answer

Port Lockdown controls which ports and protocols aSelf IPwill respond to.
However, certain traffic types bypass Port Lockdown for BIG-IP functionality and routing integrity.
The three types that areNOT affectedby Port Lockdown are:
* 1. Defined Virtual Server Traffic
Traffic destined to a Self IP that matches aconfigured virtual serveris always accepted by the BIG-IP, regardless of Port Lockdown settings.
This ensures that traffic processing does not break when administrators restrict Self-IP ports.
* 2. ICMP (Internet Control Message Protocol)
ICMP (such as ping, traceroute responses, etc.) always passes through a Self IP even when Port Lockdown is set to:
Allow Default
Allow None
Allow Custom
F5 allows ICMP for reachability and diagnostic purposes independent of Port Lockdown rules.
* 3. Centralized Management Infrastructure (CMI)
CMI includes the internal HA services used for:
Device Trust
ConfigSync
Failover
Mirroring
These essential HA communications bypass Port Lockdown to prevent accidental cluster failure.
The well-known port for this traffic isTCP 4353, which is always permitted.
Why the other options are incorrect:
Option A:SSHisrestricted by Port Lockdown unless explicitly allowed.
Option B:Same issue — SSH does not bypass Port Lockdown.
OnlyDefined VS Traffic,ICMP, andCMIbypass Port Lockdown.

Question 5

How can the BIG-IP Administrator tell when anunlicensed modulehas been provisioned?

Accepted Answer

The BIG-IP system has built-in licensing enforcement.
If an administrator provisions a module that the device isnot licensedto run, the system will still allow the provisioning action to occurinitially, but the system detects
the mismatch and displays an alert.
What actually happens:
 The GUI places awarning bannerin theupper-left cornerlabeled something similar to:??Provisioning Warning??

Certshared now are offering 100% pass ensure F5CAB1 dumps!
/exam/F5CAB1/ (42 Q&As)
 This appears immediately after provisioning a module that is not included in the active license.
 The system remains in an ??inconsistent state?? until the module is disabled again or the license is updated.
This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.
Why the other options are incorrect:
* A. ??A BIG-IP does not allow unlicensed modules to be provisioned.??
 Not true. BIG-IPdoesallow provisioning, but warns afterward.
* B. ??A warning will appear when provisioning an unlicensed module.??
 The warning doesnotappear during the provisioning step itself.
 It appearsafter provisioning, in the main GUI, as a system banner.

Question 6

A BIG-IP device is licensed forLTM, ASM, APM, and AFM.
Currently, it will only be used forload balancingandweb application firewalling.
To ensure optimal performance and efficient resource utilization, which of the following module provisioning combinations is the best choice?

Accepted Answer

BIG-IP provisioning determines how CPU, memory, and disk resources are allocated to each module. The goal is to provision only the modules required and at
levels appropriate to their performance needs.
Requirements in the question
The device will be used for:
 LTM(Local Traffic Manager) # load balancing
 ASM(Application Security Manager) # WAF No functions require:
 APM (Access Policy Manager)
 AFM (Advanced Firewall Manager)
Why Option C is correct
Provisioning bothLTMandASMatNominallevel provides:
 Adequate performance for production load
 Plentiful system resources while avoiding dedicating the entire system to a single module
 Balanced allocation without starving memory or CPU
SettingAPM: NoneandAFM: Noneensures unused modules consume zero resources.
Why the other options are incorrect
* A. Dedicated provisioning for both LTM and ASM
 Two modules cannot both run in ??Dedicated?? mode.
 Dedicated mode allocatesallresources to a single module — the second module cannot be dedicated simultaneously.
* B. LTM and ASM both Dedicated
 Same issue: only one module can be Dedicated at a time.
 Also unnecessary for load balancing + WAF.
* D. Setting APM and AFM to Minimal
 Minimal still consumes memory and CPU.
 Unused modules should be set toNone.
Therefore,Option Cis the best provisioning strategy.

Question 7

For security reasons, a BIG-IP Administrator needs to specify allowable IP ranges for access to the Configuration Utility (WebUI).
The exhibit shows the User Administration section of the Configuration Utility.

Certshared now are offering 100% pass ensure F5CAB1 dumps!
/exam/F5CAB1/ (42 Q&As)
The administrator could not find any setting that explicitly restricts access to the Configuration Utility. Which one of the following is a reason for that?

Accepted Answer

The screenshot shown is from theUser Administrationsection of the BIG-IP GUI. This section controls:
 Root and Admin passwords
 SSH Access
 SSH IP Allow settings
However,it does not contain any controls for restricting access to the WebUI (TMUI).
BIG-IP does not provide TMUI access restrictions from this part of the GUI.
Access to the web-based Configuration Utility is controlled by thehttpd allow list, configured through TMSH:
tmsh modify /sys httpd allow { <IP/subnet> }
This setting is not displayed in the User Administration panel, and in many BIG-IP versions, the httpd allow list isonly configurable from the CLI, not the GUI.
Therefore, the administrator cannot find the setting in the screen shown because:
 TMUI access restriction isnotlocated in this GUI section
 It must be configured usingtmshunder/sys httpd allow
This is why Option A is correct.

Question 8

The device is currently onv15.1.2.1.
The BIG-IP Administrator needs to boot the device back tov13.1.0.6to gather data for troubleshooting.
The system shows: Sys::Software Status
Volume Product Version Build Active Status Allowed HD1.1 BIG-IP 15.1.2.1 0.0.10 yes complete yes HD1.2 BIG-IP 13.1.0.6 0.0.3 no complete yes
Which is the correct command-line sequence to boot the device to version13.1.0.6?

Accepted Answer

To change the boot volume on a BIG-IP system from one installed TMOS version to another, the correct CLI tool is:
switchboot
The correct syntax uses the-bflag:
switchboot -b <volume>
This command marks the specified boot location as the one to be used on the next reboot. Thus, to boot intoHD1.2which contains13.1.0.6, the sequence is:
 Mark HD1.2 as the next boot location:

Certshared now are offering 100% pass ensure F5CAB1 dumps!
/exam/F5CAB1/ (42 Q&As)
 switchboot -b HD1.2
 Reboot the system:
 reboot
This is the standard and officially supported method for selecting a different installed volume.
Why the other options are incorrect:
* A. "tmsh reboot HD1.2"
 There is no such tmsh syntax.
 Boot volume cannot be selected by adding a parameter to reboot.
* C. switchboot -I HD1.2
 The -I flag is invalid. Only -b is used.
* D. "tmsh switchboot HD1.2"
 switchboot isnota tmsh command; it is a system-level shell utility.
Therefore,Option Bis the correct and valid command sequence.

Question 9

A BIG-IP Administrator needs to purchase new licenses for a BIG-IP appliance.
The administrator needs to know:
Whether a module is licensed
The memory requirement for that module
Where should the administrator view this information in theSystem menu?

Accepted Answer

To understand:
Which modules arelicensed
Which modules areprovisioned
Theresource requirements(CPU / RAM) of each module
The administrator uses:
System » Resource Provisioning
This page displays:
All modules present in the license
Whether they are enabled or disabled
Required memory to activate each module
CPU and disk allocation information
Provisioning level options (None / Minimal / Nominal / Dedicated)
This is the exact location where BIG-IP administrators evaluate module capacity before enabling or purchasing licensing upgrades.
Why the other options are incorrect:
* A. Configuration » OVSDB
Used for network virtualization integrations, not licenses or modules.
* B. Software Management
Used for software image installation, not licensing.
* C. Configuration » Device
Displays hostname, failover settings, device properties — not module resource requirements.
Thus, module licensing and memory requirement data are found underResource Provisioning.

Question 10

A BIG-IP Administrator is responsible for deploying a new software image on an F5 BIG-IP HA pair and has scheduled a one-hour maintenance window.
With a focus on minimizing service disruption, which of the following strategies is the most appropriate?

Accepted Answer

For BIG-IP high-availability (HA) pairs, F5's recommended upgrade workflow prioritizesservice continuity,predictable failover, andminimal downtime. The
established best-practice sequence is:
Upgrade the standby unit first
Because the standby device is not passing traffic, upgrading and rebooting it does not impact production.
Boot the standby unit into the newly installed version
Once online, the administrator verifies basic health, device sync status, cluster communication, and module functionality.
Perform a controlled failover to the upgraded unit
Traffic shifts to the newly upgraded device, allowing validation of the configuration and operational behavior under real traffic loads.
Upgrade the second device (now standby)

Certshared now are offering 100% pass ensure F5CAB1 dumps!
/exam/F5CAB1/ (42 Q&As)
The previously active device becomes standby after failover, allowing it to be safely upgraded and rebooted without interruption.
This phased approach ensures only one device is unavailable at a time, allowing continuous traffic flow throughout the upgrade process.
Why the Correct Answer is C
OptionCexactly matches F5's documented production-safe upgrade method:
Upgrade thestandbynode first
Reboot into new image
Failover to upgraded device
Validate
Upgrade the remaining (now-standby) device
This procedure minimizes risk and traffic disruption.
Why the other options are incorrect:
* A. Upgrade the active node first
Upgrading the active device requires removing it from service and failing over abruptly. This is not recommended and increases service disruption risk.
* B. Resetting device trust
Resetting trust is unnecessary and can disrupt configuration sync, peer communication, and cluster operation. It is not part of any standard upgrade workflow.
* D. Upgrading and rebooting both nodes simultaneously
This would causetotal outage, because both HA members would be unavailable at the same time.