F5CAB4 Practice Questions

Physical interface properties, such as media speed and duplex settings, are configured within the Network section of the Configuration Utility (GUI). The correct path is Network > Interfaces. From this screen, the administrator can select the specific interface and manually override the auto-negotiated settings for media type, speed, and duplex to ensure compatibility with the connected network device. This is the standard graphical method for managing physical port configurations.

A. The Front Console (LCD panel) has very limited configuration capabilities, typically used for basic setup or recovery, not for detailed interface management.

B. While the TMOS Shell (tmsh) can be used to change interface settings, the Configuration Utility is also a primary and valid location as specified in the option.

D. The System > Configuration menu is for high-level device settings like licensing, provisioning, and device certificates, not for individual network interface properties.

1. F5 Networks. (2021). BIG-IP System: Essentials. "Working with network interfaces," Chapter 2. This chapter explicitly shows the Network > Interfaces path for configuring interface properties.

2. F5 Networks. (2021). TMOS Management Guide for BIG-IP Systems. "Working with BIG-IP Interfaces, Trunks, and VLANs," Chapter 4. The guide describes using the Configuration utility to manage interface settings.

3. F5 Support. (2022). K14021: BIG-IP media speed and duplex setting overview. This article details how to configure media settings and specifies using the Configuration utility via the Network > Interfaces menu.

System > Platform is where administrators configure management interface access restrictions in BIG-IP. This section contains the management port configuration settings, including allowed protocols (SSH, HTTPS, etc.) and IP address restrictions. Here, administrators can specify which IP addresses or networks are permitted to access the management interface via SSH, effectively blocking unauthorized access attempts while maintaining legitimate administrative access.

A. System > Configuration handles general system settings but not management interface access controls.

B. Network > Interfaces manages physical/logical network interfaces, not management access security policies.

C. Network > Self IPs configures virtual IP addresses for traffic processing, not management interface restrictions.

1. F5 BIG-IP System: User Account Administration Guide, Chapter 3: "Restricting Access to the Configuration Utility", Section 3.2

2. F5 Networks Official Documentation: "BIG-IP System: Essentials", Module 12: Management Access Configuration, Pages 12-15

3. F5 BIG-IP TMOS: Concepts Guide, Version 15.x, "Platform Security" chapter, sections 4.1-4.3

4. F5 Networks Knowledge Base Article K13309: "Configuring the BIG-IP system management interface"

5. F5 BIG-IP Operations Guide, "Securing Administrative Access" section, paragraphs 8-12

The BIG-IP system architecture is divided into a control plane and a data plane. The control plane is responsible for system management and administrative tasks, such as processing requests from the command-line interface (CLI), the web-based Configuration utility, and SNMP. High CPU utilization on the control plane indicates a heavy load from these administrative functions. Application traffic, including tunnel and accelerated traffic, is handled by the data plane's Traffic Management Microkernel (TMM), which uses separate CPU resources.

B. Tunnel: Tunnel traffic is processed by the data plane (TMM), not the control plane.

C. Accelerated: Accelerated traffic is handled by specialized hardware and the data plane, offloading the CPU, not increasing control plane usage.

D. Application: General application traffic is the primary responsibility of the data plane (TMM), which has dedicated CPU cores.

1. F5 Networks. (2021). TMOS Operations Guide, Chapter 2: The BIG-IP System. F5 Networks Documentation. "The control plane is the component of the BIG-IP system that you use to manage the system... Examples of control plane tasks are using the Configuration utility to create a virtual server..."

2. F5 Knowledge Base. (2022). K15202: The BIG-IP data plane and control plane. "The control plane consists of a set of processes that run on the main CPU... These processes are used for system management, administration, and monitoring."

3. F5 Knowledge Base. (2020). K10232: The BIG-IP system architecture. This document provides a diagram and description separating the control plane (Linux host OS) from the data plane (TMM).

The /var/log/secure log file is the central location for recording authentication-related events on a BIG-IP system. It captures messages from the Pluggable Authentication Modules (PAM) framework. This includes successful and failed login attempts to all management interfaces, such as the web-based Configuration Utility (processed by httpd) and the command-line interface (via sshd). An administrator would review this file to audit user access, investigate unauthorized login attempts, and troubleshoot authentication issues.

A. /var/log/pam/tallylog is a binary data file used by the pamtally2 module to track failed login attempts for account lockout purposes, not a human-readable log.

C. /var/log/ltm contains logs specific to the Local Traffic Manager (LTM) module, such as pool and node status changes, not management authentication events.

D. /var/log/httpd contains the access and error logs for the Apache web server that runs the Configuration Utility, but detailed authentication messages are syslog'd to /var/log/secure.

- F5 Networks. (2021). BIG-IP System: Administration Guide. Chapter: "Logging and Reporting". The guide describes the purpose of various log files, identifying /var/log/secure for authentication messages.

- F5 Support. (2022). K16197: Reviewing BIG-IP log files. This article provides a table of common log files and their purposes, specifying that /var/log/secure contains "Information related to authentication and authorization."

A QKView file is the primary diagnostic data file used by F5 Support and the iHealth diagnostic portal. It contains a snapshot of the BIG-IP system's configuration files, logs, and command outputs. This file is generated from the System > Support page in the Configuration Utility. On this page, an administrator can click "New Support Snapshot" to create a new QKView file, which can then be downloaded and uploaded to F5 iHealth for analysis.

A. System > Software Management is for installing and managing TMOS software versions, not for generating diagnostic files.

B. System > Archives is for creating and restoring UCS configuration backups, which are distinct from QKView diagnostic files.

C. System > Configuration is a parent menu for device, network, and user settings, not for support data generation.

1. F5 Networks. (2023). K12878: Generating BIG-IP diagnostic data using the qkview utility. F5 Support. "To generate a QKView file from the Configuration utility, perform the following procedure: 1. Log in to the Configuration utility. 2. Go to System > Support."

2. F5 Networks. (2021). BIG-IP System: Administration. Chapter: Working with BIG-IP System Support Information. "You can use the BIG-IP Configuration utility to generate and download a QKView file... On the Main tab, click System > Support."

3. F5 Networks. (2024). Welcome to F5 iHealth. F5 iHealth Portal. The primary instruction for users is to "Generate a QKView from your BIG-IP device (System > Support) and upload it here."

The /var/log/ltm file is the primary log for the Local Traffic Manager (LTM) module. It records events related to the status of LTM objects, including virtual servers, pools, and pool members. When a health monitor marks a resource up or down, or when an administrator manually enables or disables an object, the resulting status change of the virtual server is logged in this file. This makes it the correct location to investigate the history of a virtual server's availability.

A. /var/log/audit logs administrative changes to the BIG-IP configuration, not the operational status changes of LTM objects like virtual servers.

B. /var/log/lastlog is a standard Linux file that records the most recent login of users and is unrelated to BIG-IP traffic management objects.

D. /var/log/monitors contains detailed, verbose logging for specific health monitors, which is useful for debugging a monitor but is not the primary log for virtual server status events.

1. F5 Networks. (2021). BIG-IP TMOS: Operations Guide. Chapter 6: Logs and Notifications, Section: BIG-IP system log files. "The /var/log/ltm file logs traffic management-related messages."

2. F5 Knowledge Center. (2022). K16197: Reviewing BIG-IP log files. "The /var/log/ltm file contains information related to the local traffic management system, such as virtual server and pool status, and connection information."

3. F5 Knowledge Center. (2022). K07359145: The BIG-IP system logs messages related to virtual server and pool member status changes to the /var/log/ltm file. This article explicitly states that messages for virtual server status changes are logged to /var/log/ltm.

The two recommended and standard methods for an administrator to manually force an active BIG-IP system into standby mode are through the Configuration Utility (GUI) and the TMOS Shell (CLI). The GUI method involves navigating to Device Management > Devices, selecting the local device (self), and clicking the "Force to Standby" button. The CLI method involves executing the command tmsh run /sys failover standby. Both actions cause the device to release its active status for any traffic groups it owns, triggering a failover to a peer device.

A. The command tmsh run /sys failover device standby is incomplete. The correct syntax requires a device name, and it is used to force a specific (potentially remote) device to standby.

C. The "Force to Standby" option is located on the Device Management > Devices page for the specific device, not under the Traffic Groups page in the manner described.

1. F5 Networks. (2021). K15122: Forcing the active BIG-IP system to standby. MyF5. This article details the two primary methods. It provides the exact GUI path Device Management > Devices > (Self) > Force to Standby and the CLI command tmsh run /sys failover standby.

2. F5 Networks. (2021). BIG-IP TMOS: Implementations. Chapter: Setting up a High Availability System. The manual describes administrative failover procedures, including forcing a device to standby via the GUI and CLI as standard operational tasks.

3. F5 Networks. (2021). Traffic Management Shell (tmsh) Reference Guide. Section: sys failover. The reference guide documents the standby command, stating it "Causes the system to go into the standby state."

To configure a BIG-IP system to send log messages to remote Syslog servers, the administrator must navigate to the logging configuration section within the Configuration Utility. The correct path is System > Logs > Configuration. This area allows for the creation and management of log publishers and log destinations, including remote high-speed log destinations for protocols like Syslog, Splunk, and ArcSight. Here, the administrator can define the IP address and port for the new Syslog servers.

A. System > Configuration > Local Traffic is used for configuring LTM objects like virtual servers and pools, not system-level logging.

C. System > Logs > Audit is a viewer for the audit log, which tracks configuration changes. It is not used to configure log destinations.

D. System > Configuration > Device contains device-specific settings like network interfaces, HA configuration, and certificates, but not logging settings.

1. F5 Networks. (2021). BIG-IP System: Log Files and BIG-IP Alarms. Chapter: Remote Logging, Section: Configuring remote high-speed logging. "You can configure the BIG-IP system to log messages to remote servers... The first step in configuring remote high-speed logging is to create a pool of logging servers." The GUI path for this configuration is System > Logs > Configuration > Log Destinations.

2. F5 Networks. (2021). BIG-IP TMOS: Implementations. Chapter: Logging and Reporting, Section: Configuring Remote Syslog. This guide details the process, starting with navigating to System > Logs > Configuration to create log destinations and publishers.

To perform maintenance on an active BIG-IP device in a high-availability (HA) pair, the administrator must gracefully fail over the traffic group to a peer device. The "Force to Standby" option is the designated function in the BIG-IP system to initiate this process. This action changes the status of the traffic group on the current device to standby, prompting the peer device with the next best availability score to become active for that traffic group, thus ensuring service continuity.

A. Creating a new Traffic Group is unnecessary and does not address moving the existing active workload to a peer device for maintenance.

B. While "Failover" is the general concept, "Force to Standby" is the specific command used in the BIG-IP interface to initiate a graceful failover.

D. "Demote" is not a standard term or action used within the BIG-IP system for managing traffic group failover.

1. F5 Networks. (2021). BIG-IP Device Service Clustering: Administration. Chapter: Managing Traffic Groups, Section: Forcing a traffic group to a standby state. "You can temporarily force an active traffic group on a device to a standby state... This is useful when you need to perform maintenance on a device that is currently active for a traffic group."

2. F5 Networks. (2021). BIG-IP LTM: Implementations. K15122: Overview of BIG-IP Traffic Management Shell (tmsh). The run /sys failover standby command is the CLI equivalent of the "Force to Standby" GUI action.

A device group is a configuration object that contains other objects (the device members). To delete a container object like a device group, it must first be empty. The BIG-IP Administrator must remove all device members, including both the active and the decommissioned devices, from the device group's configuration. Once the device group has no members, the system will permit its deletion. Attempting to delete a non-empty device group will result in an error.

A. Disable the device group: Disabling a device group stops synchronization but does not change its membership, thus not allowing its deletion.

C. Remove the decommissioned device from the device group: This is only a partial step. The remaining active member must also be removed before the group can be deleted.

D. Make sure all members of the device group are in sync: This is impossible if a device is decommissioned and is a prerequisite for normal operation, not deletion.

1. F5 Networks. (2021). BIG-IP Device Service Clustering: Administration, Chapter: Deleting a device group. F5 Networks Documentation. "Before you can delete a device group, you must first remove all BIG-IP devices from the group."

2. F5 Networks. (2021). BIG-IP Device Service Clustering: Administration, Chapter: Removing a device from a device group. F5 Networks Documentation. This section details the procedure for removing a member, which is a prerequisite for deleting the group itself.