F5CAB1 Exam Questions & Answers

Port Lockdown controls which ports and protocols a Self IP will respond to.

The Allow Default setting permits only a predefined set of BIG-IP internal and required service ports.

The Allow Default list includes:

TCP 443 HTTPS (Management/TMUI access via Self-IP)

TCP 4353 CMI (device sync)

TCP/UDP ports related to HA communication

Other essential internal F5 ports

Why TCP 443 is correct:

It is one of the officially allowed ports under Allow Default.

It enables HTTPS/TMUI access through a Self IP.

Why the other options are incorrect:

A . TCP 80 (HTTP)

Not allowed under Allow Default

HTTP via Self-IP is blocked unless placed under Allow Custom

B . UDP 8443

Not an F5 default service

Not part of the Allow Default ports

When installing a BIG-IP software version with a HotFix on a new boot volume, F5 requires that both the base TMOS image and the HotFix image be installed together as part of the same installation workflow.

The correct process is:

Specify the base TMOS ISO

Specify the HotFix ISO that corresponds to that base version

Instruct the system to create a new boot volume

Install both images into that new volume

This is achieved with the following tmsh syntax:

tmsh install /sys software BIGIP-<version>.iso hotfix Hotfix-BIGIP-<version>-ENG.iso create-volume HD1.2

This command:

Installs the base image first

Applies the HotFix on top of the base image

Creates and installs everything on HD1.2

Leaves the currently active volume untouched for rollback

Why the other options are incorrect

A . Installing only the hotfix

A HotFix cannot be installed by itself on a new volume. A base image must already be present.

C . Using create instead of install

The create keyword is not valid for software installation operations.

D . Using copy

The copy command does not install software images or hotfixes.

BIG-IP systems require all ISO images (base TMOS images and HotFix images) to be stored in a specific directory used for software installation:

/shared/images/

This directory:

Is the only supported location from which the BIG-IP software installation system validates and installs ISO files

Is accessible by both the GUI and TMSH installers

Has adequate storage space allocated specifically for images

Is part of the shared partition that persists across reboots

When transferring images via SCP, the administrator must copy them directly into /shared/images/ so that:

The GUI (System Software Management Available Images) can detect the image

TMSH install software image commands can reference it

Other directories such as /local/images/ or /var/images/ are not valid storage paths for software images.

To identify which boot volume is currently active on a BIG-IP system, the correct command is:

tmsh show sys software status

This command displays:

All installed boot volumes (HD1.1, HD1.2, HD1.3, etc.)

The BIG-IP software version installed on each volume

The Active field, indicating which volume the system is currently booted from

The installation status (''complete'', ''in-progress'', ''allowed'')

This is the standard and authoritative way to determine the active boot location.

Why the other options are incorrect:

A . tmsh show sys version

Displays OS version, build, and date.

Does not show boot locations or which volume is active.

C . tmsh list sys software update

Shows software update configurations, not boot volume status.

Does not display which volume is active.

Comprehensive and Detailed Explanation From BIG-IP Administration --- Install, Initial Configuration, and Upgrade:

The Service Check Date embedded in the BIG-IP license acts as a gating mechanism that determines eligibility for software updates. F5 enforces that the Service Check Date must be equal to or newer than the software release date of any BIG-IP version being installed. If the installed license carries a Service Check Date from two years ago, attempting to upgrade to a newly released BIG-IP software version --- whose release date post-dates that Service Check Date --- will fail, as the system validates this date during the upgrade process.

Option A is incorrect --- generating and uploading a QkView to F5 iHealth is a diagnostic activity that requires no license validation or Service Check Date verification whatsoever.

Option C is incorrect --- ASM signature and threat campaign updates are content updates, not platform software upgrades. These updates are independent of the Service Check Date requirement and do not trigger license validation checks during installation.

Only a platform software upgrade to a newly released BIG-IP version directly invokes the Service Check Date validation, mandating license renewal prior to the upgrade proceeding successfully.

Reference Topics: License Service Check Date, Software Upgrade Prerequisites, License Reactivation --- BIG-IP Administration Study Guide.