F5CAB1テスト問題練習試そう！2026年に更新された44問あります
更新された2026年01月プレミアムF5CAB1試験エンジンPDFで今すぐダウンロード！無料更新された44問あります
質問 # 21
Refer to the exhibit.
What traffic will be permitted to reach the BIG-IP?
- A. SSH
- B. Telnet
- C. FTP
正解：A
解説：
The exhibit shows the configuration of aSelf IPwith:
* Port Lockdown: Allow Custom
* ACustom Listthat includes the following TCP ports:
* 443
* 22
Meaning of these ports:
* TCP 443# HTTPS (TMUI - web-based management)
* TCP 22# SSH (command-line remote access)
No other TCP, UDP, or protocol entries are listed; therefore, only these two services are allowed to reach the BIG-IP via this Self IP.
Evaluating the answer choices:
Option
Service
Port
Allowed?
FTP
TCP 21
Not listed
#Not allowed
SSH
TCP 22
Listed
#Allowed
Telnet
TCP 23
Not listed
#Not allowed
Thus,SSHis the only traffic permitted through this Self IP configuration.
質問 # 22
When logged into thebash shellof a BIG-IP system, which of the following commands will display the management-ip address?
(Choose two.)
- A. ifconfig mgmt
- B. show mgmt ip
- C. tmsh list /sys management-ip
- D. list / sys management-ip
正解：A、C
解説：
When logged into thebash shellof a BIG-IP system, there are two valid ways to view themanagement-ip address:
A). tmsh list /sys management-ip
* Even from the bash shell, the administrator can enter a tmsh command by typing:
* tmsh list /sys management-ip
* This displays:
* Management IP address
* Netmask
* Any configured management routes
* This is theofficial tmsh methodfor viewing the management-ip configuration.
C). ifconfig mgmt
* In the underlying Linux OS, the management interface maps to themgmtinterface.
* Running:
* ifconfig mgmt
displays:
* Assigned management IP
* Netmask
* Link-level status
* This is a valid Linux-level method used frequently for troubleshooting.
Why the other options are incorrect:
B). show mgmt ip
* Not a valid bash or tmsh command on BIG-IP.
D). list / sys management-ip
* Missing thetmshprefix.
* In bash, this will generate a syntax error.
* The correct form requires:
tmsh list /sys management-ip
質問 # 23
A secondary administrator has been granted access to a BIG-IP device through itsManagement Interface, but is unable to access theConfiguration Utility (WebUI).
What command can be run from the CLI to capture the network traffic on themanagement interfaceand troubleshoot the issue?
(Choose two.)
- A. tcpdump -i management -n port 443
- B. tcpdump -i tun0 -n port 443
- C. tcpdump -i mgmt -n port 443
- D. tcpdump -i eth0 -n port 443
- E. tcpdump -i 0.0 -n port 443
正解：C、D
解説：
The BIG-IP has two distinct planes:
* Management-plane# handled entirely by the management interface (MGMT)
* Data-plane (TMM)# handles Self IPs, VLAN interfaces, and traffic processing To capture traffic on the management interface, only the management-side NICs may be used:
* mgmt# Logical name for the management interface
* eth0# Physical Linux interface mapped to the management port on most BIG-IP platforms Both of these correctly capture inbound/outbound WebUI (HTTPS/443) traffic on the management port.
Why the correct answers are A and B
A). tcpdump -i eth0 -n port 443
* On BIG-IP appliances and VMs, the management port maps toeth0at the Linux OS level.
* Capturing on eth0 correctly shows HTTPS traffic to the WebUI.
B). tcpdump -i mgmt -n port 443
* mgmtis the BIG-IP alias for the management interface.
* This is thepreferredand most explicit capture interface for management-plane packet captures.
Why the other options are incorrect:
C). tcpdump -i 0.0
* Interface0.0is the TMM switch interface used for data-plane packet captures.
* Itdoes NOTcapture management-plane traffic.
D). tcpdump -i tun0
* Used for tunnel interfaces (IPsec, VXLAN, etc.)
* Not related to management access.
E). tcpdump -i management
* There isnointerface named management on BIG-IP.
* The correct names are mgmt or eth0.
質問 # 24
A BIG-IP Administrator is using Secure Copy Protocol (SCP) to transfer a TMOS image to the BIG-IP system in preparation for an upgrade.
To what directory should the file be transferred?
- A. /var/images/
- B. /shared/images/
- C. /local/images/
正解：B
解説：
BIG-IP systems require all ISO images (base TMOS images and HotFix images) to be stored in a specific directory used for software installation:
/shared/images/
This directory:
* Is theonly supported locationfrom which the BIG-IP software installation system validates and installs ISO files
* Is accessible by both the GUI and TMSH installers
* Has adequate storage space allocated specifically for images
* Is part of the shared partition that persists across reboots
When transferring images via SCP, the administrator must copy them directly into/shared/images/so that:
* The GUI (System # Software Management # Available Images) can detect the image
* TMSH install software image commands can reference it
Other directories such as/local/images/or/var/images/are not valid storage paths for software images.
質問 # 25
The monitoring team reports that the SNMP server is unable to poll data from a BIG-IP device.
What information will help the BIG-IP Administrator determine whether the issue originates from the BIG-IP system?
- A. The "Port Lockdown" setting is preventing the SNMP server from polling data from the BIG-IP.
- B. The configuration on the exhibit is correct and other options should be explored.
- C. The "Traffic Group" setting must use a floating Traffic Group.
- D. The "VLAN / Tunnel" setting must allow All Vlans.
正解：A
解説：
The exhibit shows aSelf IPwith:
* VLAN:Data
* Port Lockdown:Allow None
Impact of "Allow None" on SNMP
When a Self IP is configured with:
Port Lockdown: Allow None
the BIG-IP blocksallservices and ports except a few hardcoded HA communication ports.
This means:
* UDP/161 (SNMP)is blocked
* UDP/162 (SNMP traps)is blocked
* The SNMP server cannot poll or receive data from the BIG-IP through this Self IP SNMP relies on access through the Self IP if out-of-band (mgmt interface) is not used.
Thus, the issue is directly caused byPort Lockdown = Allow None, which prevents SNMP communication.
Why the other options are incorrect:
B). Traffic Group must use a floating Traffic Group
* SNMP polling doesnotrequire floating Self IPs.
* Floating groups apply to HA failover IPs, not SNMP functionality.
C). VLAN/Tunnel must allow All VLANs
* Self IPs are always bound to a VLAN; SNMP doesnotrequire All VLANs.
* As long as the Self IP belongs to a reachable VLAN, SNMP can work.
D). Configuration is correct
* It is not correct:Allow Noneblocks SNMP and is the problem.
質問 # 26
A BIG-IP Administrator needs to verify the state of equipment in the data center.
A BIG-IP appliance has asolid yellow indicatoron the status LED.
How should the administrator interpret this LED indicator?
- A. A power supply is NOT operating properly
- B. A warning-level alarm condition is present
- C. Appliance is halted or in End-User Diagnostic (EUD) mode
- D. Appliance is a standby member in a device group
正解：B
解説：
BIG-IP hardware platforms use chassis LEDs to indicate system health states.
Asolid yellow status LEDtypically indicates awarning condition, such as:
* A non-critical hardware alert
* A temperature threshold nearing limit
* A minor fan or sensor irregularity
* Other non-fatal environmental or system conditions
This state reflects awarning-level alarm, meaning the unit is operational but requires investigation.
Why the other options are incorrect
A). Halted or EUD mode
* This is associated with different LED patterns (usually flashing conditions or specific color codes), not a solid yellow status LED.
B). Standby in device group
* HA state is not indicated by the chassis status LED.
* Standby status is alogicaldevice state, not a hardware LED state.
D). Power supply failure
* Power supply indicators use separate LEDs located on each power module (usually flashing amber/red), not the system status LED.
Thus, asolid yellow status indicatorsignifies awarning-level alarm.
質問 # 27
How should a BIG-IP Administrator check theprovisioned CPU percentfor a module?
(Choose two.)
- A. By running thetopcommand and reviewing the output for the provisioned module.
- B. By going toSystem / Resource Provisioningand hovering over the CPU section colors.
- C. By checking theDashboardoutput in the Statistics tab in the GUI.
- D. By runningtmsh show /sys provisionand reviewing the specific module in the output.
- E. By runningtmsh show /sys cpuand reviewing the specific module provisioned output.
正解：B、D
解説：
BIG-IP allocates CPU and memory resources based on module provisioning levels.
To view how much CPU a module is assigned, administrators must check provisioning information from:
C). GUI - System Resource Provisioning
This page visually displays CPU allocation via color-coded bars.
Hovering over the CPU bar shows:
* CPU usage percent per module
* Which modules share CPU cycles
* The system's total resource allocation
This is the primary GUI method.
D). tmsh show /sys provision
This command displays detailed module provisioning information including:
* Provisioned modules
* Their provisioning level
* CPU and memory allocation data
It is the authoritative CLI method for resource provisioning status.
Why the other options are incorrect:
A). top
* Shows real-time process usage, notprovisionedCPU allocation.
B). tmsh show /sys cpu
* Displays CPU runtime utilization, not per-module provisioning.
E). Statistics Dashboard
* Only shows traffic / system runtime metrics, not provisioning resource allocations.
Therefore,C and Dare correct.
質問 # 28
What will setting a Self IP to"Allow None"for Port Lockdown do?
- A. Block HA communications, causing the systems to report their peer as online ready.
- B. Block HA communications, causing the systems to report their peer as offline and go active-active.
- C. Default allow port 1026 access between peer devices and traffic processing across the network failover.
正解：B
解説：
ThePort Lockdownfeature controls which services a Self-IP will respond to.
Setting a Self-IP toAllow Nonemeans:
* The Self-IP will not acceptanytraffic except the very limited, hard-coded HA ports such asTCP 4353 used for device trust and configuration sync.
* All other HA ports, including those needed for network failover and other HA mechanisms,are blocked.
When essential HA services cannot communicate, each device assumes its peer is down.
This results in:
* HA failover misbehavior
* Both devices thinking the other is offline
* Potentialactive-active condition, which is not intended and can cause traffic disruption Thus,Allow Nonecan break HA functionality unless the Self-IP is not used for HA links.
質問 # 29
The Configuration Utility of a BIG-IP device is currently accessible via its management IP10.53.1.245from all VLANs.
The BIG-IP Administrator needs to restrict access so only hosts from the10.0.0.0/24subnet can access the Configuration Utility.
Which TMSH command accomplishes this?
- A. (tmos)# create /net acl MGMT.HTTP rule add { (permit tcp 10.0.0.0 0.0.0.255 host 10.53.1.245 http) }
- B. (tmos)# modify /ltm httpd allow replace-all-with {10.0.0.0/24}
- C. (tmos)# create /net acl MGMT.HTTP rule add { (permit tcp 10.0.0.0/24 10.53.1.245 http) (deny ip any any http) }
- D. (tmos)# modify /sys httpd allow replace-all-with {10.0.0.0/24}
正解：D
解説：
BIG-IP controls access to the web-based Configuration Utility (TMUI) through the/sys httpd allowlist. This parameter specifies which client IPs or subnets may initiate HTTP/HTTPS connections to the management interface.
To restrict TMUI access toonlythe 10.0.0.0/24 subnet:
* The correct method is tomodify the HTTPD allow listso that it contains only this subnet.
* This requires replacing the entire current list with the new subnet using:
modify /sys httpd allow replace-all-with {10.0.0.0/24}
This ensures thatonlyclients within 10.0.0.0/24 can reach the Configuration Utility.
Why the other options are incorrect:
* Options A and Ccreate network ACL objects under /net acl, which apply to data-plane traffic, not management-plane TMUI access. TMUI access is not controlled by LTM ACLs but by the HTTPD allow directive.
* Option Bis incorrect syntax and references /ltm httpd, which is not the proper object; the correct hierarchy is /sys httpd.
Thus, only modifying the/sys httpd allowlist achieves the required restriction.
質問 # 30
A BIG-IP Administrator plans to upgrade a BIG-IP device to the latest TMOS version.
Which two tools could the administrator leverage to verify known issues for the target versions? (Choose two.)
- A. F5 End User Diagnostics (EUD)
- B. F5 University
- C. F5 Bug Tracker
- D. F5 iHealth
- E. F5 Downloads
正解：C、D
解説：
Comprehensive and Detailed Explanation (Paraphrased from F5 BIG-IP Administration Install, Initial Configuration, and Upgrade concepts) When performing a TMOS upgrade, F5 recommends validating the target software version to ensure that the release does not contain defects that may impact system behavior. The upgrade preparation process includes checking for known issues, validating compatibility, and reviewing advisory information for the intended version. Two primary F5 tools serve this purpose:
B). F5 iHealth
iHealth is a cloud-based diagnostic and analysis platform used to evaluate the operational state of a BIG-IP system.
Administrators upload a QKView file to iHealth to receive an automated assessment of the system. As part of upgrade planning, iHealth provides:
* Version-specific issue analysis, comparing the system's configuration and hardware against F5's internal catalog of published issues.
* Upgrade advisories, identifying potential risks such as deprecated features, module compatibility concerns, or changes in behavior between TMOS versions.
* Checks against known defects, allowing administrators to determine whether the target TMOS version contains issues relevant to their deployment.
This aligns with F5's recommended upgrade workflow, where iHealth is used before upgrading to confirm system readiness and detect software-level concerns.
D). F5 Bug Tracker
The Bug Tracker is F5's dedicated interface for reviewing software defects across TMOS releases.
It enables administrators to:
* Search forknown bugs by TMOS version, module, severity, or defect ID.
* Review thestatus of defects(open, resolved, fixed in later releases).
* Identify whether high-impact or security-related issues are associated with the target upgrade version.
F5 documentation emphasizes reviewing known defects prior to installation of new software images, making the Bug Tracker a critical resource for upgrade validation.
Why the other options are not correct
A). F5 End User Diagnostics (EUD)
EUD is used exclusively forhardware diagnostics(ports, memory, fans). It does not provide software-related issue verification and is not used for upgrade planning.
C). F5 University
This is atraining platform, not an operational tool. It does not provide defect listings or upgrade-specific warnings.
E). F5 Downloads
Although it provides access to software images and release notes, it isnot a tool for identifying known bugs.
Release notes summarize general fixes and features, but systematic bug verification requires iHealth or the Bug Tracker.
質問 # 31
A BIG-IP Administrator needs to install aHotFixon a standalone BIG-IP device.
The device currently hasHD1.1as the Active Boot Location.
The administrator has already reactivated the license and created a UCS archive.
In which sequence should the administrator perform theremaining steps?
- A. Activate HD1.2, Install base Image in HD1.2, Install HotFix in HD1.2
- B. Install HotFix in HD1.1, Reboot the BIG-IP device, Install UCS Archive
- C. Install HotFix in HD1.2, Install base Image in HD1.2, Activate HD1.2
- D. Install base Image in HD1.2, Install HotFix in HD1.2, Activate HD1.2
正解：D
解説：
When installing a software upgrade with a HotFix on BIG-IP, the correct workflow requires:
* Install the base TMOS imageon an unused boot volume
* Install the corresponding HotFixonto that same boot volume
* Activate the updated boot volumeto boot into the new software
This method ensures:
* The existing active system (HD1.1) is untouched
* The upgrade occurs in a new, clean volume (HD1.2)
* The HotFix applies properly to the same base image
* The administrator can revert to HD1.1 if issues occur
OptionCmatches the correct F5 upgrade sequence:
1. Install base image on HD1.2
2. Install HotFix on HD1.2
3. Activate HD1.2
Why the other options are incorrect:
A). Install HotFix before base image
* HotFixes must be appliedafterthe base image; not valid.
B). Installing a HotFix on the active boot location (HD1.1)
* Not recommended and does not use a clean new volume.
* Also does not involve installing the base image.
D). Activating HD1.2 before installing anything
* Cannot activate an empty or invalid boot volume.
Thus,Option Cis the correct sequence.
質問 # 32
A BIG-IP Administrator needs to install a HotFix on a standalone BIG-IP device, which hasHD1.1as the Active Boot Location.
The administrator has already re-activated the license and created a UCS archive.
In which sequence should the administrator perform the remaining steps?
- A. Activate HD1.2, Install base Image in HD1.2, Install HotFix in HD1.2
- B. Install HotFix in HD1.1, Reboot the BIG-IP device, Install UCS Archive
- C. Install HotFix in HD1.2, Install base Image in HD1.2, Activate HD1.2
- D. Install base Image in HD1.2, Install HotFix in HD1.2, Activate HD1.2
正解：D
解説：
When installing a HotFix on a BIG-IP device, F5 best practices require:
* Installing the base TMOS image on a new, unused boot volume (HD1.2)
* This ensures the upgrade happens on a clean volume.
* The existing active boot location remains untouched for rollback.
* Installing the HotFix onto the SAME new boot volume (HD1.2)
* HotFixes must be applied on top of a base version.
* They cannot be installed on an empty volume.
* They must match the base image version.
* Activating the new boot volume (HD1.2)
* The system reboots into the updated software stack.
* Activation happensafterbase + HotFix installation is complete.
This sequence is exactly shown inOption C:
Install base Image in HD1.2
Install HotFix in HD1.2
Activate HD1.2
Why the other options are incorrect:
A). Install HotFix before base image
* Impossible.
* HotFix requires an installed base version first.
B). Installing HotFix on HD1.1 (active boot volume)
* Not recommended.
* Upgrading in-place removes rollback safety.
* HotFix cannot be applied cleanly without applying base image first.
D). Activate HD1.2 before installing anything
* You cannot activate an empty boot volume.
* Activation only occurs after the base + HotFix software is installed.
質問 # 33
A new logging solution is being implemented on the network. Policy requires keeping management traffic sent from the BIG-IPout of the management interface. After configuring the BIG-IP to forward messages to the new Syslog server, the BIG-IP Administrator notices that packets are being sentfrom a numbered data- plane Self IP.
What should the BIG-IP Administrator change to send the traffic out of thecorrect interface?
- A. Set the Management IP as the source address when configuring a Remote Syslog destination.
- B. Create a new Self IP in the same subnet as the management IP address using a route domain.
- C. Modify the port lockdown settings on the Self IP address to allow UDP port 514 traffic.
- D. Create a Management Route for the specific address/subnet of the syslog service via TMSH.
正解：D
解説：
By default,management-plane trafficuses themanagement routing table, whiledata-plane trafficuses the TMM routing table.
Remote Syslog traffic ismanagement-planetrafficunlessa management route exists.
If noManagement Routematches the Syslog server's destination IP, the BIG-IP will instead:
* UseTMM routes, and
* Source the packets from aSelf IP
This is exactly what the administrator is observing.
To force Syslog traffic out the management port:
You must create aManagement Route, which is configured using:
tmsh create /sys management-route <name> gateway <ip> network <syslog subnet> This sends syslog traffic:
* Out of themanagement interface
* Using theManagement IPas the source
Thus,Option Bis correct.
Why the other options are incorrect:
A). Set the Management IP as the source address
* Source address selection is overridden by routing.
* Without a management route, traffic still goes out the data plane.
C). Create a new Self IP using a route domain
* Unnecessary and not related to management-plane routing.
* Syslog traffic should not rely on data-plane Self IPs.
D). Modify port lockdown on Self IP to allow UDP/514
* This would allow Syslog trafficintothe BIG-IP over a Self IP, not forceoutboundtraffic via management.
質問 # 34
The BIG-IP Administrator needs to update access to the Configuration Utility to include the172.28.31.0/24and
172.28.65.0/24networks.
From the TMOS Shell (tmsh), which command should the BIG-IP Administrator use to complete this task?
- A. modify /sys httpd allow add { 172.28.31.0 172.28.65.0 }
- B. modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
- C. modify /sys httpd permit add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
正解：B
解説：
Access to the BIG-IP Configuration Utility (TMUI) is controlled through the/sys httpd allowlist.
This list defines which IP addresses or subnets are allowed to connect to the management web interface.
To allow two new subnets-172.28.31.0/24and172.28.65.0/24-the administrator mustaddboth subnets to the existing list without removing current entries.
In tmsh, subnet entries must be specified innetwork/netmask format, for example:
172.28.31.0/255.255.255.0
The correct tmsh command to append these networks is:
modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 } Why the other options are incorrect:
Option B:
* IPs are listed without masks, which is invalid for subnet-based access control.
* The system requiresnetwork/netmaskformat.
Option C:
* The command uses permit instead of allow, which is not a valid attribute of /sys httpd.
* The correct keyword must beallow.
Thus, onlyOption Acorrectly adds both permitted subnets in the proper tmsh format.
質問 # 35
The BIG-IP Administrator needs to update access to the Configuration Utility to include the172.28.31.0/24and
172.28.65.0/24networks.
From the TMOS Shell (tmsh), which command should the BIG-IP Administrator use to complete this task?
- A. modify /sys httpd allow add { 172.28.31.0 172.28.65.0 }
- B. modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
- C. modify /sys httpd permit add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }
正解：B
解説：
Access to the BIG-IP Configuration Utility (TMUI) is controlled through the/sys httpd allowlist.
This list defines which IP addresses or subnets are allowed to connect to the management web interface.
To allow two new subnets-172.28.31.0/24and172.28.65.0/24-the administrator mustaddboth subnets to the existing list without removing current entries.
In tmsh, subnet entries must be specified innetwork/netmask format, for example:
172.28.31.0/255.255.255.0
The correct tmsh command to append these networks is:
modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 } Why the other options are incorrect:
Option B:
* IPs are listed without masks, which is invalid for subnet-based access control.
* The system requiresnetwork/netmaskformat.
Option C:
* The command uses permit instead of allow, which is not a valid attribute of /sys httpd.
* The correct keyword must beallow.
Thus, onlyOption Acorrectly adds both permitted subnets in the proper tmsh format.
質問 # 36
Refer to the exhibit.
An organization has purchased a BIG-IP license that includes all available modules but has chosen to provision only the modules they require.
The exhibit displays the current resource allocation from theSystem # Resource Provisioningpage.
Based on the information provided, which F5 modules have been provisioned?
- A. LTM, APM
- B. LTM, DNS, APM
- C. DNS, APM
- D. TMM, DNS, APS
正解：B
解説：
The exhibit shows theCurrent Resource Allocationfor:
* CPU
* Disk
* Memory
In particular, theMemory Allocationbar displays the modules that are currently provisioned.
Memory is the most reliable indicator because BIG-IP allocates memoryonlyto modules that are actively provisioned.
From the exhibit:
* MGMT(Management) - always present
* TMM(Traffic Management Microkernel) - indicatesLTM is provisioned
* GTM- this label indicates that theDNS moduleis provisioned (GTM = Global Traffic Manager, now called DNS)
* APM- explicitly shown, indicatingAccess Policy Manageris provisioned
Therefore, the provisioned modules are:
* LTM(implied by TMM allocation)
* DNS/GTM
* APM
This matchesOption C: LTM, DNS, APM.
質問 # 37
A BIG-IP device is licensed forLTM, ASM, APM, and AFM.
Currently, it will only be used forload balancingandweb application firewalling.
To ensure optimal performance and efficient resource utilization, which of the following module provisioning combinations is the best choice?
- A. LTM: Dedicated
ASM: Dedicated
APM: None
AFM: None - B. LTM: Nominal
ASM: Nominal
APM: None
AFM: None - C. LTM: Dedicated
ASM: Dedicated
APM: Minimal
AFM: Minimal - D. LTM: Nominal
ASM: Nominal
APM: Minimal
AFM: Minimal
正解：B
解説：
BIG-IP provisioning determines how CPU, memory, and disk resources are allocated to each module. The goal is to provision only the modules required and at levels appropriate to their performance needs.
Requirements in the question
The device will be used for:
* LTM(Local Traffic Manager) # load balancing
* ASM(Application Security Manager) # WAF
No functions require:
* APM (Access Policy Manager)
* AFM (Advanced Firewall Manager)
Why Option C is correct
Provisioning bothLTMandASMatNominallevel provides:
* Adequate performance for production load
* Plentiful system resources while avoiding dedicating the entire system to a single module
* Balanced allocation without starving memory or CPU
SettingAPM: NoneandAFM: Noneensures unused modules consume zero resources.
Why the other options are incorrect
A). Dedicated provisioning for both LTM and ASM
* Two modules cannot both run in "Dedicated" mode.
* Dedicated mode allocatesallresources to a single module - the second module cannot be dedicated simultaneously.
B). LTM and ASM both Dedicated
* Same issue: only one module can be Dedicated at a time.
* Also unnecessary for load balancing + WAF.
D). Setting APM and AFM to Minimal
* Minimal still consumes memory and CPU.
* Unused modules should be set toNone.
Therefore,Option Cis the best provisioning strategy.
質問 # 38
What are the two options for securing a BIG-IP's management interface?
(Choose two.)
- A. Block all management-interface administrative HTTPS and SSH service ports to prevent access.
- B. Use the BIG-IP's Self-IP addresses for administrative access rather than the management interface.
- C. Restrict administrative HTTPS and SSH access to specific IP addresses or IP ranges.
- D. Limiting network access through the management interface to a trusted/secured network VLAN.
正解：C、D
解説：
Securing the BIG-IP management interface is a fundamental administrative responsibility. F5 best practices emphasize restricting who can reach the management port and ensuring that only authorized systems are allowed access.
A). Limiting management access to trusted network segments
F5 recommends placing the management interface on adedicated, isolated, and secured management network or VLAN, rather than exposing it to production or untrusted networks.
This reduces the attack surface by ensuring only trusted segments have visibility to administrative interfaces.
D). Restricting management access by IP or subnet
F5 BIG-IP uses the/sys httpd allowlist (for HTTPS) and configuration options insshd(for SSH) to control which IP addresses or subnets can access the device.
By specifying only known administrative IPs or ranges, unauthorized users cannot reach the login services.
Why the other options are incorrect
B). Blocking all management HTTPS/SSH ports
* This would prevent any administrative access and is not a viable security practice.
C). Using Self-IP addresses for administrative access
* F5 explicitly warns against using Self-IPs for management access unless strictly necessary.
* Self-IPs are exposed to the data plane and should not be used as the primary administrative interface.
質問 # 39
......
正真正銘のF5CAB1問題集には100%合格率練習テスト問題集：https://www.jpntest.com/shiken/F5CAB1-mondaishu
F5 F5CAB1リアル試験問題保証付き更新された問題集にはJPNTest：https://drive.google.com/open?id=1dS3hsmue37LfGh6x9sJjKZyCMmcqXHPY