F5 Networks F5CAB1 Exam Dumps

Provisioning defines how BIG-IP allocates system resources to modules. The provisioning levels include:

Dedicated -- allocates all CPU, memory, and disk resources to a single module

Nominal -- standard resource allocation balanced with other modules

Minimal -- lowest level, used for basic utility needs

None -- module disabled

Comprehensive / Maximal -- not valid TMOS provisioning levels

Why ''Dedicated'' is correct

When a BIG-IP device is intended to run only ASM (Web Application Firewall), the recommended way to maximize performance is to provision the module at Dedicated level.

With ASM: Dedicated:

ASM receives the entire hardware capacity

No other modules can or should be provisioned

This is explicitly recommended when a device is used solely as a WAF platform

Why other options are incorrect

B . Comprehensive / C. Maximal

These are not valid provisioning modes in BIG-IP.

TMOS supports: Nominal, Minimal, Large (module-specific), and Dedicated.

D . Nominal

Shares resources with other modules

Does not provide full system performance

Not suitable when exclusive resource allocation is required

Thus, Dedicated is the correct provisioning choice.

Self-IPs implement a security feature known as Port Lockdown, which limits which services are reachable on a Self-IP.

However, certain services required for BIG-IP device-to-device communication bypass Port Lockdown to ensure cluster and HA functionality.

TCP 4353

TCP port 4353 is used by Device Service Clustering (DSC) for:

Device trust establishment

Configuration synchronization

Failover communication

Because BIG-IP devices must always be able to communicate for HA functions to remain operational, port 4353 is exempt from Port Lockdown rules.

Why the other options are incorrect

A . TCP 443

Not required for device trust or synchronization.

HTTPS access is fully controlled by Port Lockdown.

C . UDP 53

DNS traffic is not required for synchronization and has no exemption under Port Lockdown.

Self-IPs include a security feature called Port Lockdown, which restricts which services respond on that Self-IP.

By default, Self-IPs block management access (SSH and HTTPS/TMUI), meaning an administrator cannot manage the device through in-band Self-IPs unless explicitly allowed.

Allow Mgmt / Allow Management

These settings enable only the management services required for administrative access, specifically:

SSH (22)

HTTPS/TMUI (443)

These options allow secure administration without opening unnecessary ports.

Why these are correct:

They provide only the essential access for management.

They follow F5 security best practices when using in-band admin access.

They do not expose all services, reducing the attack surface.

Why the other options are incorrect:

A . Allow Default

This allows only a minimal set of system-required ports (e.g., failover, config sync), not SSH or HTTPS.

Administrator access would still fail.

B . Allow All

Opens all ports on the Self-IP, which is not secure.

Exposes services that should remain restricted.

Therefore, Allow Mgmt / Allow Management are the correct choices.

The HTTPD allow list controls which IP addresses or subnets may access the Configuration Utility (TMUI) on the BIG-IP system. The Administrator already has two subnets allowed and needs to add a single host IP to the existing list.

The object /sys httpd allow supports actions such as add, delete, and replace-all-with.

Because the goal is to add one more entry without removing the existing permitted subnets, the correct command is:

modify /sys httpd allow add { 172.28.32.22 }

This appends the new host to the existing list while preserving the previously configured networks.

Why the other options are incorrect:

Option A (replace-all-with) would overwrite the entire allow list, removing existing permitted subnets---unacceptable.

Option B (delete) would remove the existing networks and not add the required host.

Therefore, the correct administrative action is to add the jump host's IP.

The BIG-IP system has built-in licensing enforcement.

If an administrator provisions a module that the device is not licensed to run, the system will still allow the provisioning action to occur initially, but the system detects the mismatch and displays an alert.

What actually happens:

The GUI places a warning banner in the upper-left corner labeled something similar to:

''Provisioning Warning''

This appears immediately after provisioning a module that is not included in the active license.

The system remains in an ''inconsistent state'' until the module is disabled again or the license is updated.

This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.

Why the other options are incorrect:

A . ''A BIG-IP does not allow unlicensed modules to be provisioned.''

Not true. BIG-IP does allow provisioning, but warns afterward.

B . ''A warning will appear when provisioning an unlicensed module.''

The warning does not appear during the provisioning step itself.

It appears after provisioning, in the main GUI, as a system banner.