F5CAB1 Exam Questions & Answers
BIG-IP Administration Install, Initial Configuration, and Upgrade • F5 Networks
100% money-back guarantee
Sample F5CAB1 Questions
Practice with real exam-style questions, each with the verified correct answer and explanation.
Which one of the following is a port and protocol combination allowed by the Allow Default setting for Port Lockdown?
Port Lockdown controls which ports and protocols a Self IP will respond to.
The Allow Default setting permits only a predefined set of BIG-IP internal and required service ports.
The Allow Default list includes:
TCP 443 HTTPS (Management/TMUI access via Self-IP)
TCP 4353 CMI (device sync)
TCP/UDP ports related to HA communication
Other essential internal F5 ports
Why TCP 443 is correct:
It is one of the officially allowed ports under Allow Default.
It enables HTTPS/TMUI access through a Self IP.
Why the other options are incorrect:
A . TCP 80 (HTTP)
Not allowed under Allow Default
HTTP via Self-IP is blocked unless placed under Allow Custom
B . UDP 8443
Not an F5 default service
Not part of the Allow Default ports
Given that BIGIP-
(Choose one.)
When installing a BIG-IP software version with a HotFix on a new boot volume, F5 requires that both the base TMOS image and the HotFix image be installed together as part of the same installation workflow.
The correct process is:
Specify the base TMOS ISO
Specify the HotFix ISO that corresponds to that base version
Instruct the system to create a new boot volume
Install both images into that new volume
This is achieved with the following tmsh syntax:
tmsh install /sys software BIGIP-<version>.iso hotfix Hotfix-BIGIP-<version>-ENG.iso create-volume HD1.2
This command:
Installs the base image first
Applies the HotFix on top of the base image
Creates and installs everything on HD1.2
Leaves the currently active volume untouched for rollback
Why the other options are incorrect
A . Installing only the hotfix
A HotFix cannot be installed by itself on a new volume. A base image must already be present.
C . Using create instead of install
The create keyword is not valid for software installation operations.
D . Using copy
The copy command does not install software images or hotfixes.
A BIG-IP Administrator is using Secure Copy Protocol (SCP) to transfer a TMOS image to the BIG-IP system in preparation for an upgrade.
To what directory should the file be transferred?
BIG-IP systems require all ISO images (base TMOS images and HotFix images) to be stored in a specific directory used for software installation:
/shared/images/
This directory:
Is the only supported location from which the BIG-IP software installation system validates and installs ISO files
Is accessible by both the GUI and TMSH installers
Has adequate storage space allocated specifically for images
Is part of the shared partition that persists across reboots
When transferring images via SCP, the administrator must copy them directly into /shared/images/ so that:
The GUI (System Software Management Available Images) can detect the image
TMSH install software image commands can reference it
Other directories such as /local/images/ or /var/images/ are not valid storage paths for software images.
Which command will display the current active volume on a BIG-IP system?
To identify which boot volume is currently active on a BIG-IP system, the correct command is:
tmsh show sys software status
This command displays:
All installed boot volumes (HD1.1, HD1.2, HD1.3, etc.)
The BIG-IP software version installed on each volume
The Active field, indicating which volume the system is currently booted from
The installation status (''complete'', ''in-progress'', ''allowed'')
This is the standard and authoritative way to determine the active boot location.
Why the other options are incorrect:
A . tmsh show sys version
Displays OS version, build, and date.
Does not show boot locations or which volume is active.
C . tmsh list sys software update
Shows software update configurations, not boot volume status.
Does not display which volume is active.
modification]
The Service Check Date on the license matches the date that the BIG-IP was installed two years ago. Which of the following activities would require the BIG-IP Administrator to renew the license and update the Service Check Date for it to work?
Comprehensive and Detailed Explanation From BIG-IP Administration --- Install, Initial Configuration, and Upgrade:
The Service Check Date embedded in the BIG-IP license acts as a gating mechanism that determines eligibility for software updates. F5 enforces that the Service Check Date must be equal to or newer than the software release date of any BIG-IP version being installed. If the installed license carries a Service Check Date from two years ago, attempting to upgrade to a newly released BIG-IP software version --- whose release date post-dates that Service Check Date --- will fail, as the system validates this date during the upgrade process.
Option A is incorrect --- generating and uploading a QkView to F5 iHealth is a diagnostic activity that requires no license validation or Service Check Date verification whatsoever.
Option C is incorrect --- ASM signature and threat campaign updates are content updates, not platform software upgrades. These updates are independent of the Service Check Date requirement and do not trigger license validation checks during installation.
Only a platform software upgrade to a newly released BIG-IP version directly invokes the Service Check Date validation, mandating license renewal prior to the upgrade proceeding successfully.
Reference Topics: License Service Check Date, Software Upgrade Prerequisites, License Reactivation --- BIG-IP Administration Study Guide.
Get access to all 49 verified questions with detailed answers.
Unlock All F5CAB1 Questions