The 'Dedicated' provisioning level is specifically designed for a BIG-IP system that will perform a single primary function, such as acting as a Web Application Firewall (WAF) with the Application Security Manager (ASM) module. When a module is set to 'Dedicated', the BIG-IP system allocates the maximum available CPU, memory, and disk resources to that module. This ensures optimal performance for its specialized task by preventing resource contention from other, unprovisioned modules. This directly aligns with the requirement to dedicate all system resources to the ASM module exclusively.

B. Comprehensive: This is not a valid or recognized resource provisioning level within the BIG-IP Traffic Management Operating System (TMOS).

C. Maximal: This is not a valid or recognized resource provisioning level within the BIG-IP TMOS. It is likely a distractor term.

D. Nominal: This is the default provisioning level. It provides a balanced allocation of resources suitable for running multiple modules concurrently and does not dedicate all resources to a single module.

---

1. F5 Networks, BIG-IP System: Administration Guide (v16.1). "Resource Provisioning," Chapter: About resource provisioning for BIG-IP modules. The guide states, "Dedicated: Allocates the majority of system resources to the selected module. Use this setting when you plan to run a single module on the BIG-IP system."

2. F5 Networks Knowledge Base, K15930: Overview of BIG-IP provisioning. "Provisioning Levels" section. This article details the different levels, explaining that "Dedicated" is used for single-module deployments to allocate the most resources to it.

3. F5 Networks, BIG-IP Application Security Manager: Implementations Guide (v16.1). "Initial Provisioning and Setup," Chapter 1: Getting Started with BIG-IP ASM. The guide recommends provisioning ASM as 'Dedicated' on appliances intended to function primarily as a WAF for best performance.

The Port Lockdown feature on a BIG-IP Self IP address is a security control that specifies which network ports and protocols are permitted. Setting this feature to “Allow None” configures a strict default-deny policy, blocking all traffic to and from that Self IP address.

High Availability (HA) functionality, including network failover and state mirroring, depends on communication over specific ports (e.g., UDP 1026, TCP 4353). If the Self IP used for HA communication is set to “Allow None,” this essential traffic will be blocked. As a result, each BIG-IP unit will be unable to receive heartbeat packets from its peer, assume the peer is offline, and attempt to become the active unit. This leads to an active-active state, causing IP address conflicts and service outages.

B. Blocking HA communications would cause the peer to be reported as offline or unknown, not "online ready."

C. The "Allow None" setting explicitly blocks all ports. The "Allow Default" setting, not "Allow None," is what permits default HA ports like 1026.

1. F5 Networks Knowledge Base, K17333: Overview of port lockdown behavior.

Section: "Port lockdown settings"

Content: This article explicitly states, "Allow None: The BIG-IP system allows no traffic to the self IP address." It further warns, "F5 recommends that you do not use the Allow None setting for self IP addresses that you use for network failover or BIG-IP GTM iQuery traffic." This directly supports that the setting blocks HA traffic.

2. F5 Networks Knowledge Base, K2397: Ports required for BIG-IP features.

Section: "BIG-IP LTM"

Content: This document lists the specific ports required for HA. For "Network failover," it specifies UDP port 1026. For "Device service clustering (DSC)," it specifies TCP port 4353. Setting Port Lockdown to "Allow None" would block these required ports.

3. F5 BIG-IP TMOS: Implementations, Version 17.1.

Chapter: "Securing Self IP Addresses" -> Section: "Understanding port lockdown"

Content: The documentation describes Port Lockdown as a mechanism to secure the BIG-IP system from unwanted connection attempts. It details the "Allow None" option as the most restrictive setting, which disallows any service on any port, thereby preventing the communication necessary for HA functions if applied to the relevant Self IP.

After a TMOS image file is uploaded to the /shared/images/ directory, the BIG-IP system's lind process automatically detects the new file. This process then performs an integrity check by verifying the internal MD5 checksum of the image file. This verification ensures the file is not corrupt or incomplete. Only after the checksum is successfully validated will the image be listed as available in the Configuration utility (GUI) under System » Software Management » Image List, ready for installation.

A. The system performs a reboot into the new partition.

A system reboot is a manual action performed by the administrator after the new image has been installed into a specific boot location, not automatically upon file upload.

C. The system copies the image to /var/local/images/.

The /shared/images/ directory is the designated location for software images. The system reads from this directory and does not copy the image to another location to make it visible.

---

1. F5 Networks Knowledge Base, K13432: The BIG-IP system may not display a software image that was manually copied to the BIG-IP system.

Reference Section: Description and Recommended Actions paragraphs.

Content: This document explicitly states, "The lind process is responsible for finding and verifying software images located in the /shared/images directory. The lind process verifies the MD5 checksum of the image file. If the checksum is valid, the image is displayed in the Configuration utility." This directly confirms that checksum verification is the step performed before the image appears in the GUI.

2. F5 BIG-IP TMOS: Operations Guide, Version 16.1

Reference Section: Chapter 2: BIG-IP system software, Section: About software images.

Content: The guide explains that when you upload a software image, "the BIG-IP system automatically checks to ensure that the software image is valid for the specific BIG-IP platform." This validation process includes the integrity check (checksum).

3. F5 BIG-IP System: Software Management, Version 15.1

Reference Section: Chapter: Managing Software Images, Section: Importing software images.

Content: The documentation details the process of making images available. It notes that after uploading, the system processes the file. The status of the image will be "verifying image" or similar before it becomes "available," which aligns with the checksum verification step.

After a TMOS image file is uploaded to the /shared/images/ directory, the BIG-IP system's installation daemon, lind, automatically detects the new file. The lind process then performs a validation check to ensure the file is a legitimate and uncorrupted software image. This validation includes verifying the file's internal checksum and digital signature. Only after this integrity check is successfully completed will the image be considered valid and subsequently displayed in the list of available images in the Configuration utility (GUI) under System » Software Management » Image List.

A. The system performs a reboot into a new partition.

This is incorrect. A system reboot is part of the software installation process, which is manually initiated by the administrator after the image has been verified and selected from the GUI.

C. The system copies the image to /var/local/images/.

This is incorrect. The /shared/images/ directory is the designated and persistent location for software images. The system does not automatically copy the image to another directory as part of the verification process.

1. F5 Networks Knowledge Base, K13432: The BIG-IP system may not display a software image that was manually copied to the /shared/images directory.

Section/Paragraph: "Cause" and "Recommended Actions" sections.

Content: This document explicitly states, "The lind process is responsible for verifying software images and populating the list of available images for the Configuration utility and the TMOS Shell (tmsh)." It details that this process involves checksum verification.

2. F5 BIG-IP System: Software Administration Guide (v17.x)

Chapter: Managing Software Images

Section: About software images

Content: The guide explains that when you upload a software image, the system automatically verifies its digital signature to ensure the authenticity and integrity of the software image before it can be used for an installation. This verification is a prerequisite for the image appearing as a valid option.

3. F5 Networks Knowledge Base, K84554655: TMM may restart after uploading a software image to the BIG-IP system.

Section/Paragraph: "Description" section.

Content: This article notes, "When you upload a software image file to the /shared/images/ directory on the BIG-IP system, the lind process scans the file to verify that it is a valid BIG-IP software image file." This confirms an automated verification scan occurs upon upload.

The exhibit displays the BIG-IP system's Resource Provisioning screen, which is used to allocate system memory and CPU resources to licensed modules. A module is considered active or "provisioned" when its provisioning level is set to a value other than "None".

The screenshot clearly shows that "Local Traffic (LTM)", "Global Traffic (DNS)", and "Access Policy (APM)" are all set to "Nominal". The "Nominal" setting allocates a standard amount of resources for the module to run. All other modules listed have their provisioning set to "None", indicating they are not allocated resources and are inactive. Therefore, LTM, DNS, and APM are the provisioned modules.

A. LTM, APM: This answer is incomplete as it omits Global Traffic (DNS), which is also shown as provisioned to "Nominal" in the exhibit.

B. DNS, APM: This answer is incomplete as it omits Local Traffic (LTM), which is also shown as provisioned to "Nominal" in the exhibit.

D. TMM, DNS, APS: TMM (Traffic Management Microkernel) is the core system component, not a provisionable module in this context. APS is not a valid module acronym shown.

1. F5 BIG-IP System: Administration Guide (v17.1), Chapter: "BIG-IP system essentials", Section: "Resource provisioning". The guide states, "When you provision resources for the BIG-IP system, you are specifying the amount of system memory and CPU that the system allocates to the BIG-IP modules... If you plan to not use a module, you can set its provisioning level to None." This confirms that modules set to "Nominal" are provisioned and active.

2. F5 Knowledge Center, K14358: Overview of BIG-IP resource provisioning. This article explains the different provisioning levels. It clarifies: "When you provision a BIG-IP module, you are allocating system resources, such as CPU and memory, to that module... Nominal - This is the default provisioning level for many BIG-IP modules." This directly supports the interpretation of the exhibit.

3. F5 BIG-IP Local Traffic Manager: Getting Started Guide (v17.1), Chapter: "Initial BIG-IP system setup", Section: "Provisioning BIG-IP modules". This document outlines the initial setup process, which includes provisioning. It reinforces that selecting a level like "Nominal" activates the module by allocating the necessary system resources.

The Resource Provisioning screen, located under the System menu in the BIG-IP Configuration utility, is the correct location for this task. This interface displays a comprehensive list of all available BIG-IP modules and indicates their current licensing status (e.g., Licensed, Unlicensed). Furthermore, it is the designated area for administrators to allocate system memory and CPU resources to licensed modules by setting a provisioning level (None, Minimum, Nominal, or Dedicated). This directly addresses both requirements of the administrator: viewing license status and understanding memory requirements for each module.

A. Configuration » OVSDB: This section is for configuring and managing the Open vSwitch Database, which is used for network virtualization features like VXLAN, not for module licensing.

B. Software Management: This area is used to manage BIG-IP software images, hotfixes, and boot volumes, not for allocating resources to specific modules.

C. Configuration » Device: This section contains general device-level settings, such as device certificates, device groups, and traffic groups, but not module resource allocation.

1. F5 BIG-IP System: Administration Guide (v17.1), Chapter: "Managing System Resources", Section: "Provisioning resources for BIG-IP modules".

The guide states, "You use the Resource Provisioning screen in the BIG-IP Configuration utility to provision resources for the BIG-IP modules... On the Main tab, click System > Resource Provisioning. The Resource Provisioning screen opens, displaying a list of the BIG-IP modules." This section details how the screen shows licensed modules and allows for setting provisioning levels which dictate memory allocation.

2. F5 Knowledge Base Article K15935595: Overview of BIG-IP VE and BIG-IQ VE license and resource provisioning.

This article explains, "You can view the licensed modules and provision resources for them by navigating to System > Resource Provisioning." This directly confirms the function and location described in the question.

The correct and safest procedure for installing a BIG-IP software update involves using an inactive boot location. This preserves the currently running software on the active volume (HD1.1), allowing for a simple rollback if the upgrade encounters issues. The installation process requires installing the base TMOS image first, as a HotFix is a patch designed to modify that specific base version. After the base image is installed on the inactive volume (HD1.2), the HotFix is applied to the same volume. Finally, the administrator activates the newly prepared volume, which configures the system to boot from it upon the next restart.

A. A HotFix is a patch for a base image and cannot be installed before the base software it is intended to modify.

B. Installing a HotFix directly onto the active boot location is not a recommended best practice as it eliminates the immediate rollback capability.

D. A boot location must have software installed on it before it can be activated for the system to boot from it.

1. F5 Networks Knowledge Base, K84554955: Overview of BIG-IP system software installation.

Section: "Installation tasks"

Content: This document explicitly states, "When you install a new version of BIG-IP software, you must install the base ISO image for that version first, and then you can install a hotfix ISO image for that version." It also emphasizes the best practice: "F5 recommends that you perform the software installation on an inactive boot location."

2. F5 BIG-IP TMOS: Operations Guide, v16.1

Chapter: "BIG-IP Software and System Management"

Section: "Installing BIG-IP software"

Content: The guide details the procedure, showing that the user must first select an inactive volume, install the base software image, and then optionally install a point release or hotfix to that same volume before rebooting into it.

3. F5 Networks Knowledge Base, K34745165: Managing software images on the BIG-IP system.

Section: "Installing a software image to a new boot location"

Content: This article provides a step-by-step guide that confirms the sequence: select an inactive volume, install the desired software image (base), and then install any required hotfixes. The final step before rebooting is to change the default boot location, which corresponds to activation.

The BIG-IP system's management interface settings, including access controls for services like SSH, are configured on the System > Platform screen. This is the specific location in the Configuration Utility where an administrator can define a list of IP addresses or subnets permitted to establish SSH connections to the management IP address. Implementing this restriction is a fundamental security measure to mitigate brute-force attacks by ensuring only trusted sources can access the device's management plane.

A. Network > Interfaces: This section is used to configure physical interface properties like speed, duplex, and VLAN membership, not service access lists.

B. Network > Self IPs: This configures IP addresses for data plane traffic on VLANs. Its "Port Lockdown" feature does not apply to the dedicated management interface.

C. System > Configuration: This is a parent menu. While the correct screen is located within this menu, System > Platform is the specific and most accurate location for the task.

1. F5 Networks. (2021). BIG-IP System: Essentials, Chapter: Administrative Access to the BIG-IP System, Section: Securing access to the management port. The documentation states, "You can use the Configuration utility to specify the IP addresses that are allowed to access the BIG-IP system through the management port. On the Main tab, click System > Platform."

2. F5 Knowledge Base. (2022). K5380: Specifying the IP addresses that can connect to the BIG-IP system. The procedural steps clearly instruct the user to "Log in to the Configuration utility. Navigate to System > Platform."

3. F5 Knowledge Base. (2023). K13092: Overview of securing access to the BIG-IP system, Section: Management interface. This article explains the security concept: "You can secure access to the BIG-IP management interface by configuring the system to accept secure shell (SSH) connections from only specific IP addresses or subnets." The configuration for this is located under System > Platform.

This question is likely flawed as presented. The exhibit clearly shows the Port Lockdown setting as Allow None, which explicitly blocks all TCP and UDP traffic to this Self IP address, including FTP, SSH, and Telnet. However, in the context of a certification exam, such a question often intends to test knowledge of the common Allow Default setting. The Allow Default option permits a specific list of essential services for management and high availability. Among the choices provided, only SSH is part of this default list, as it is the standard for secure administration.

A. FTP: This is an insecure file transfer protocol and is not included in the Allow Default service list for management access on a BIG-IP Self IP.

C. Telnet: This is an insecure remote access protocol and is not included in the Allow Default service list due to its lack of encryption.

1. F5 Knowledge Center, K17333: Overview of port lockdown behavior: This article details the behavior of each Port Lockdown setting.

Section: Port Lockdown Settings > Allow None: "The Allow None option specifies that the BIG-IP system allows no traffic to the self IP address." It lists exceptions like ICMP and routing protocols, but not SSH, FTP, or Telnet.

Section: Port Lockdown Settings > Allow Default: "The Allow Default option specifies that the BIG-IP system allows traffic for a pre-defined set of network protocols and services." The article then lists the services, which explicitly include TCP port 22 (SSH), but not FTP or Telnet. This supports the reasoning that the question is likely testing knowledge of this default list.

2. F5 BIG-IP TMOS: Implementations, Chapter 3: Configuring Self IP Addresses: This guide describes the configuration of Self IPs and their properties.

Section: Securing access to the BIG-IP system: "For the Port Lockdown setting, you can choose to allow access for a default set of protocols, or you can customize the list. The default protocols include services such as SSH, HTTPS, and iQuery." This confirms SSH is a default-allowed service, unlike the other options.

The switchboot utility is the standard command-line tool for managing BIG-IP boot locations from the bash shell. The command switchboot -b HD1.2 sets the specified volume, HD1.2, as the active location for the next system boot. This action modifies the boot configuration but does not immediately restart the device. A subsequent reboot command is required to initiate the restart process, which will then load the newly designated active volume, HD1.2, containing version 13.1.0.6.

A. The tmsh reboot command does not accept a volume name as an argument; its syntax is simply tmsh reboot.

C. The correct flag to specify a boot volume with the switchboot utility is -b, not -I.

D. The switchboot utility is a bash shell command, not a tmsh module. The syntax tmsh switchboot is invalid.

1. F5 Networks Knowledge Base, K16461: Manually activating a new boot location.

Section: "Changing the active boot location from the command line"

Content: This document explicitly states: "To change the active boot location from the command line, you can use the switchboot utility... For example, to switch the active boot location to HD1.2, type the following command: switchboot -b HD1.2". It further instructs to "reboot the system by typing the following command: reboot". This directly validates the sequence in the correct answer.

2. F5 BIG-IP TMOS: Command Line Interface Guide, Version 15.1.0.

Section: "reboot"

Content: The guide details the tmsh reboot command syntax, which does not include an option to specify a boot volume directly (e.g., tmsh reboot HD1.2). It does, however, document the tmsh reboot volume command, which performs both actions in one step, but this specific command is not presented as an option in the question. This confirms that option A is syntactically incorrect.

3. F5 BIG-IP Systems: Getting Started, Version 15.1.0.

Chapter: "Maintaining the BIG-IP System" -> Section: "Managing software images"

Content: This guide describes the process of managing software volumes. While often focusing on the GUI, it references the underlying command-line tools for advanced administration, confirming that switchboot is the designated utility for this task outside of tmsh or the GUI.