Free F5CAB4 Practice Test Questions and Answers (2026) Practice Questions

The message "Peer Time Out of Sync" displayed in the BIG-IP command-line prompt indicates that the system clock of the local device differs from the system clock of a peer device in the device group by a significant margin (typically more than 300 seconds). This is a critical condition as proper time synchronization is essential for high-availability (HA) functions, including configuration synchronization (ConfigSync) and failover. The message itself does not specify which device has the correct time, only that a discrepancy exists.

A. This is a potential root cause for the time discrepancy, but the message itself directly indicates the symptom—a time difference with the peer—not the cause.

B. An unreachable peer would result in a different status message, such as "Peer Disconnected," not a message specifically about time synchronization.

C. The message does not imply which device's time is correct or incorrect; it only reports that the times are not synchronized between the local and peer systems.

1. F5 Networks. (2021). K15093: The BIG-IP system command line prompt may include the 'Peer Time Out of Sync' message. MyF5. In the "Description" section, it states, "The BIG-IP system command line prompt may include the Peer Time Out of Sync message when the system time of the local device differs from the system time of a peer device by more than 300 seconds."

2. F5 Networks. (2021). BIG-IP Device Service Clustering: Administration. Chapter: Troubleshooting device service clustering. The manual emphasizes the requirement for synchronized Network Time Protocol (NTP) settings across all devices in a group to prevent such errors.

A User Configuration Set (UCS) file is an archive containing the BIG-IP system's configuration files. The Configuration Utility provides a dedicated interface for managing these archives. To restore a UCS file, the administrator must navigate to System > Archives. This section allows for the creation of new archives, as well as uploading and installing (restoring) existing UCS files to the device. This is the central location for all backup and restore operations involving UCS files within the GUI.

A. Local Traffic > Virtual Servers is used for configuring and managing virtual servers, not for system-level backup and restore operations.

B. Local Traffic > Policies is used for creating and managing local traffic policies that control how the system processes traffic.

D. System > Configuration contains general system settings like licensing and device certificates, but the specific task of managing UCS archives is located in System > Archives.

1. F5 Knowledge Center. (2022). K13132: Backing up and restoring BIG-IP configuration files with a UCS archive. Section: "Restoring a UCS archive using the Configuration utility," Step 2 explicitly directs the user to navigate to System > Archives.

2. F5 Networks. (2021). BIG-IP System: Essentials. Chapter 10: BIG-IP System Administration and Maintenance, Section: Backing up and restoring the system configuration. This chapter details the use of the System > Archives page for UCS management.

3. F5 Networks. (2021). TMOS Management Guide for BIG-IP Systems. Chapter: System-Level Administration, Section: Managing Configuration Archives. This section describes the GUI path System > Archives for creating, restoring, and managing UCS files.

TMM (Traffic Management Microkernel) is the primary process responsible for traffic processing in BIG-IP systems. When module provisioning changes, TMM must restart to load new module functionality, reallocate memory resources, and initialize the newly provisioned services. This is necessary because ASM (Application Security Manager) requires specific processing engines and memory allocations that must be integrated into the TMM runtime environment.

A. bd - The big database daemon manages configuration; it doesn't require restart for provisioning changes.

C. sshd - SSH daemon is unaffected by module provisioning changes.

D. httpd - Web server process continues running; only management GUI features may update.

1. F5 BIG-IP System: Essentials (F5-SYS-ESS), Module 3: System Configuration, Section 3.2 "Provisioning and Resource Management"

2. F5 TMOS Operations Guide v15.1, Chapter 4 "System Provisioning", pages 87-92

3. F5 Knowledge Base Article K13423: "Overview of BIG-IP TMM Process Architecture"

The BIG-IP system's web-based Configuration Utility runs on the httpd service. For security, access to this service can be restricted to a specific list of IP addresses or subnets. If the IP address of the administrator's workstation is not included in this "httpd Allow" list, the BIG-IP system will refuse the HTTPS connection attempt. This is a common security hardening step and a frequent cause of management access issues. This list is configured using the TMOS Shell (tmsh).

A. The port lockdown setting applies to self IPs (traffic interfaces), not the dedicated management interface, which has its own access controls.

B. An incorrect management route is possible, but the httpd allow list is a more specific, application-level control that directly governs HTTPS access to the GUI.

C. The term "P Allow" list is not a standard BIG-IP configuration item for the management interface; the correct term is the httpd service's allow list.

1. F5 Knowledge Center. (2023). K13309: Restricting access to the Configuration utility by source IP address. This article explicitly states, "You can secure the BIG-IP Configuration utility by specifying the IP addresses that are allowed to access the utility." It provides the tmsh modify sys httpd allow command.

2. F5 Networks. (2021). BIG-IP System: Essentials. Chapter 3: BIG-IP System Setup, Section: Securing access to the BIG-IP system. This guide discusses restricting access to the management port as a fundamental security measure.

3. F5 Knowledge Center. (2022). K51233544: The BIG-IP system may erroneously allow access to the Configuration utility. This security advisory discusses the importance and function of the httpd allowed address list (sys httpd allow).

The /var/log/audit file is the designated log for tracking administrative actions and configuration changes on a BIG-IP system. It records events initiated through the Configuration utility (GUI), the Traffic Management Shell (tmsh), and iControl REST API calls. Each log entry contains the timestamp, the username of the administrator, their source IP address, and the specific configuration command or change that was executed. This makes it the definitive source for auditing who changed a virtual server configuration.

B: /var/log/secure logs authentication-related events, such as successful or failed logins and SSH access, not configuration modifications.

C: /var/log/ltm logs traffic-related events for the Local Traffic Manager module, such as pool member status changes, not administrative changes.

1. F5 Networks. (2022). K11438: Overview of BIG-IP log files. F5 Support. Retrieved from https://support.f5.com/csp/article/K11438. Table entry for /var/log/audit.

2. F5 Networks. (2021). BIG-IP TMOS: Operations Guide. F5 Cloud Docs. Retrieved from https://techdocs.f5.com/kb/en-us/products/big-ipltm/manuals/product/tmos-operations-guide-13-1-0/10.html. Section: "Auditing BIG-IP system events".

The BIG-IP system uses the /var/log/audit file to record messages related to configuration changes. This includes any modifications made by an administrator through the Configuration Utility (GUI), the Traffic Management Shell (tmsh), or iControl API calls. Each log entry contains crucial audit information, such as the timestamp, the user who performed the action, their source IP address, and the specific command or change that was executed. This provides a detailed and secure trail of all administrative actions on the device.

A. /var/log/messages: This file contains general system-level messages and is not specifically for logging administrative configuration changes.

C. /var/log/user.log: This log is not the standard location for detailed BIG-IP configuration audit trails.

D. /var/log/secure: This log file is primarily used for authentication-related messages, such as user logins and sudo attempts, not configuration modifications.

F5 Networks. (2021). BIG-IP TMOS: Operations Guide. "Log Files". This guide details the purpose of various log files, specifying that /var/log/audit is for configuration change auditing.

F5 Knowledge Base. (2022). K16197: Reviewing BIG-IP log files. F5, Inc. This article explicitly states, "/var/log/audit: Contains information related to configuration changes on the BIG-IP system."

The Network Time Protocol (NTP) settings are considered a core part of the device's system-level configuration. Within the BIG-IP Configuration Utility (GUI), these settings are located under the System menu. The specific path is System > Configuration > Device > NTP. This section allows an administrator to define the NTP servers the BIG-IP system will use to synchronize its system clock, which is essential for accurate logging, certificate validation, and time-based operations.

A. System > Platform: This section contains settings related to the physical hardware platform, such as the LCD display and chassis fan settings, not network services like NTP.

B. System > Preferences: This area is for configuring user-specific settings for the management interface, such as the number of items displayed in a list.

C. System > Services: This page is used to start, stop, and restart system daemons (e.g., sshd, httpd), not to configure their operational parameters like server addresses.

1. F5 Networks (2021). BIG-IP System: Essentials, Version 16.1. "Setting the time zone," Chapter 3: BIG-IP System Setup. The guide directs users to the System > Configuration > Device > NTP page to configure NTP servers.

2. F5 Networks (2021). BIG-IP System: Administration, Version 16.1. "Synchronizing the BIG-IP System Time with an NTP Server." This section explicitly details the procedure using the path System > Configuration > Device > NTP.

The /var/log/secure file on a BIG-IP system is the primary log for authentication and authorization events. It records all login attempts to the device, including SSH, the Configuration utility (GUI), and tmsh. When troubleshooting remote authentication failures, such as with LDAP, this file will contain detailed messages from the Pluggable Authentication Modules (PAM) subsystem, indicating the reason for the failure (e.g., incorrect credentials, connection issues to the LDAP server, or misconfigured search parameters).

B. /var/log/messages is a general system log and is less specific for authentication issues, which are directed to /var/log/secure.

C. /var/log/ltm contains logs specific to the Local Traffic Manager module, such as virtual server connections and pool member status, not system-level user authentication.

D. /var/log/user.log is not the standard log file used by the BIG-IP system for recording administrative login attempts or remote authentication events.

1. F5 Networks. (2022). K13333: Troubleshooting remote authentication. AskF5. "The BIG-IP system logs messages related to user authentication to the /var/log/secure file."

2. F5 Networks. (2021). BIG-IP System: Administration, v16.1. F5 Documentation. Chapter: Logging and Reporting, Section: About BIG-IP system log files. The table lists /var/log/secure for "Information about authentication and authorization."

3. F5 Networks. (2021). BIG-IP System: Essentials, v16.1. F5 Documentation. Chapter: BIG-IP system utilities and logs, Section: Log files. "The /var/log/secure file contains information related to authentication and authorization."

The End-User Diagnostics (EUD) utility is a pre-boot software tool used to perform hardware tests when the main Traffic Management Operating System (TMOS) fails to load. This low-level access is achieved by connecting a terminal emulator to the BIG-IP system's serial console port and rebooting the device. During the boot sequence, the administrator can interrupt the process to access the boot menu, from which the EUD can be launched. Network interfaces, including the management port, are not available until the operating system has successfully booted.

B. Internal VLAN interface: This is a data plane interface and is unavailable if the system cannot boot into the TMOS operating system.

C. External VLAN interface: This is a data plane interface and is unavailable if the system cannot boot into the TMOS operating system.

D. Management Port: The management port requires a functional operating system and network stack, which are not available during a boot failure.

1. F5 Knowledge Base. (2023). K7172: End-User Diagnostics software. "You can run the EUD package from the boot menu, which is accessible from the serial console of the BIG-IP system."

2. F5 Networks. (2019). Platform Guide: iSeries. F5 Networks Documentation. The guide for specific hardware platforms details the procedure for running EUD, which consistently specifies connecting via the serial console port. (e.g., Section: "Running the End-User Diagnostics").

In the Traffic Management Shell (tmsh), the list command is used to display the configured properties of a component. The component for the SSH daemon is /sys sshd. The specific property that defines the allowed IP address ranges is allow. Therefore, the command tmsh list /sys sshd allow correctly queries and displays the list of IP addresses and network ranges that are configured to be permitted to access the management interface via SSH.

A: The show command is used for displaying runtime statistics and status information, not for viewing the static configuration.

C: This syntax is invalid. tmsh does not accept a full file path like /etc/hosts.allow as an argument in this context.

D: This syntax is invalid for the same reason as option C; tmsh does not operate on file paths in this manner.

1. F5 Networks. (2021). Traffic Management Shell (tmsh) Reference Guide. F5 Cloud Docs. Retrieved from https://techdocs.f5.com/kb/en-us/products/big-ipltm/manuals/product/tmsh-reference-13-1-0/24.html. Component: sys sshd.

2. F5 Networks. (2020). K13408: Restricting access to the BIG-IP management interface using network firewalls. F5 Support. Retrieved from https://support.f5.com/csp/article/K13408. Section: "Restricting access to the management port".