Pass the F5-CA F5CAB1 Questions and answers with Dumpstech

BIG-IP controls access to the web-based Configuration Utility (TMUI) through the/sys httpd allowlist. This parameter specifies which client IPs or subnets may initiate HTTP/HTTPS connections to the management interface.

To restrict TMUI access toonlythe 10.0.0.0/24 subnet:

The correct method is tomodify the HTTPD allow listso that it contains only this subnet.

This requires replacing the entire current list with the new subnet using:

modify /sys httpd allow replace-all-with {10.0.0.0/24}

This ensures thatonlyclients within 10.0.0.0/24 can reach the Configuration Utility.

Why the other options are incorrect:

Options A and Ccreate network ACL objects under /net acl, which apply to data-plane traffic, not management-plane TMUI access. TMUI access is not controlled by LTM ACLs but by the HTTPD allow directive.

Option Bis incorrect syntax and references /ltm httpd, which is not the proper object; the correct hierarchy is /sys httpd.

Thus, only modifying the/sys httpd allowlist achieves the required restriction.

When you chooseAutomaticas the activation method in the License › Re-activate screen, the BIG-IP device itself contacts F5’slicense activation serviceover the Internet.

For successful automatic activation:

The BIG-IP must have outbound network connectivity (typically via the management interface).

DNS resolution and routing must allow it to reach theF5 license activation host(the one shown in option D).

The device sends its dossier and registration key to that service and receives an updated license file in return, which is then installed automatically.

The other hostnames in the options are not used by BIG-IP for license activation, so they cannot be correct in the context ofAutomatic Activation.

Provisioning defines how BIG-IP allocates system resources to modules. The provisioning levels include:

Dedicated– allocatesallCPU, memory, and disk resources to a single module

Nominal– standard resource allocation balanced with other modules

Minimal– lowest level, used for basic utility needs

None– module disabled

Comprehensive / Maximal– not valid TMOS provisioning levels

Why “Dedicated” is correct

When a BIG-IP device is intended to runonly ASM(Web Application Firewall), the recommended way to maximize performance is to provision the module atDedicatedlevel.

WithASM: Dedicated:

ASM receives theentire hardware capacity

No other modules can or should be provisioned

This is explicitly recommended when a device is used solely as a WAF platform

Why other options are incorrect

B. Comprehensive / C. Maximal

These arenot valid provisioning modesin BIG-IP.

TMOS supports: Nominal, Minimal, Large (module-specific), and Dedicated.

D. Nominal

Shares resources with other modules

Does not provide full system performance

Not suitable when exclusive resource allocation is required

Thus,Dedicatedis the correct provisioning choice.

The BIG-IP system has built-in licensing enforcement.

If an administrator provisions a module that the device is not licensed to run, the system will still allow the provisioning action to occur initially , but the system detects the mismatch and displays an alert.

What actually happens:

The GUI places a warning banner in the upper-left corner labeled something similar to: “Provisioning Warning”

This appears immediately after provisioning a module that is not included in the active license.

The system remains in an “inconsistent state” until the module is disabled again or the license is updated.

This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.

Why the other options are incorrect:

A. “A BIG-IP does not allow unlicensed modules to be provisioned.”

Not true. BIG-IP does allow provisioning, but warns afterward.

B. “A warning will appear when provisioning an unlicensed module.”

The warning does not appear during the provisioning step itself.

It appears after provisioning , in the main GUI, as a system banner.

The Port Lockdown feature controls which services a Self-IP will respond to.

Setting a Self-IP to Allow None means:

The Self-IP will not accept any traffic except the very limited, hard-coded HA ports such as TCP 4353 used for device trust and configuration sync.

All other HA ports , including those needed for network failover and other HA mechanisms, are blocked .

When essential HA services cannot communicate, each device assumes its peer is down.

This results in:

HA failover misbehavior

Both devices thinking the other is offline

Potential active-active condition , which is not intended and can cause traffic disruption

Thus, Allow None can break HA functionality unless the Self-IP is not used for HA links.

Access to the BIG-IP Configuration Utility (TMUI) is controlled through the /sys httpd allow list.

This list defines which IP addresses or subnets are allowed to connect to the management web interface.

To allow two new subnets— 172.28.31.0/24 and 172.28.65.0/24 —the administrator must add both subnets to the existing list without removing current entries.

In tmsh, subnet entries must be specified in network/netmask format , for example:

172.28.31.0/255.255.255.0

The correct tmsh command to append these networks is:

modify /sys httpd allow add { 172.28.31.0/255.255.255.0 172.28.65.0/255.255.255.0 }

Why the other options are incorrect:

Option B:

IPs are listed without masks, which is invalid for subnet-based access control.

The system requires network/netmask format.

Option C:

The command uses permit instead of allow, which is not a valid attribute of /sys httpd.

The correct keyword must be allow .

Thus, only Option A correctly adds both permitted subnets in the proper tmsh format.

A newly deployed BIG-IP Virtual Edition (VE) in VMware requires initial configuration of its management-ip address so it can be accessed over the network. F5 provides several valid mechanisms during initial console access:

A. Running the config utility

The config script is available on new BIG-IP installations and VE deployments.

It launches a guided text-based wizard allowing configuration of:

Management IP

Netmask

Default route

This is a standard and recommended method during first-time setup.

B. Using TMSH with create sys management-ip

Administrators can enter TMSH directly from the console and run:

create sys management-ip < ip > / < mask >

The management-ip object resides under sys , not under ltm or any other module.

This is the correct tmsh method for defining the management interface address.

Why the other options are incorrect:

C. create ltm management-ip

There is no such object under /ltm.

LTM handles traffic objects (virtual servers, pools), not system management interfaces.

D. Running the setup command

The setup command is used for general system configuration but does not configure the management-ip .

It is not the supported method for initial management IP assignment on VE deployments.

Therefore, the valid methods are running the config utility and using the sys management-ip command within TMSH.

The exhibit shows the Current Resource Allocation for:

CPU

Disk

Memory

In particular, the Memory Allocation bar displays the modules that are currently provisioned.

Memory is the most reliable indicator because BIG-IP allocates memory only to modules that are actively provisioned.

From the exhibit:

MGMT (Management) – always present

TMM (Traffic Management Microkernel) – indicates LTM is provisioned

GTM – this label indicates that the DNS module is provisioned (GTM = Global Traffic Manager, now called DNS)

APM – explicitly shown, indicating Access Policy Manager is provisioned

Therefore, the provisioned modules are:

LTM (implied by TMM allocation)

DNS/GTM

APM

This matches Option C: LTM, DNS, APM .

To understand:

Which modules are licensed

Which modules are provisioned

The resource requirements (CPU / RAM) of each module

The administrator uses:

System » Resource Provisioning

This page displays:

All modules present in the license

Whether they are enabled or disabled

Required memory to activate each module

CPU and disk allocation information

Provisioning level options (None / Minimal / Nominal / Dedicated)

This is the exact location where BIG-IP administrators evaluate module capacity before enabling or purchasing licensing upgrades.

Why the other options are incorrect:

A. Configuration » OVSDB

Used for network virtualization integrations, not licenses or modules.

B. Software Management

Used for software image installation, not licensing.

C. Configuration » Device

Displays hostname, failover settings, device properties — not module resource requirements.

Thus, module licensing and memory requirement data are found under Resource Provisioning .

Comprehensive and Detailed Explanation From BIG-IP Administration — Install, Initial Configuration, and Upgrade:

When provisioning modules on a BIG-IP system, F5 provides specific resource allocation settings that define how system resources — CPU, memory, and disk — are distributed to each licensed module. The two valid and officially recognised allocation settings are Nominal and Dedicated .

Nominal instructs the system to allocate a moderate, balanced share of resources to the module. It allows the module to function effectively while sharing system resources with other provisioned modules. This is the most commonly used setting in multi-module deployments.

Dedicated allocates the maximum available system resources exclusively to a single module. When this setting is applied, it is typically the only module provisioned, as it consumes resources at a level that prevents other modules from operating concurrently in a meaningful capacity.

Option A — Maximum is not a valid BIG-IP provisioning allocation level; it does not appear in the official provisioning interface or documentation as a selectable resource tier.

Option C — Limited similarly does not exist as a defined resource allocation setting within BIG-IP module provisioning. It may superficially resemble valid terminology but has no standing in the official provisioning framework.

Administrators access these settings via System » Resource Provisioning in the Configuration Utility, where each licensed module displays its available allocation options.

Reference Topics: Module Resource Provisioning, Nominal vs. Dedicated Allocation, System Resource Management — BIG-IP Administration Study Guide.