F5 F5CAB4 BIG-IP Administration Control Plane Administration (F5CAB4) exam Exam Practice Test

On a BIG-IP system, NTP (Network Time Protocol) configuration is part of the system-level configuration settings. In the Configuration Utility, NTP servers are configured under the System configuration hierarchy.

The correct navigation path is:

System > Configuration > Device > NTP

This location allows the administrator to:

Add, modify, or remove NTP servers

Ensure accurate system time synchronization

Maintain proper time alignment required for features such as ConfigSync, HA failover, logging, and certificate validation

Why the other options are incorrect:

A. System > Platform is used for hardware-related settings.

B. System > Preferences manages UI and user preferences.

C. System > Services controls system daemons and services, not time configuration.

Therefore, the correct answer is D. System > Configuration.

===========

The Statistics Dashboard is the primary graphical interface used by administrators to monitor the real-time performance and health of the BIG-IP system.

System-Wide Overview: Navigating to Statistics > Dashboard provides a centralized view of critical system-level metrics, including global CPU utilization (across all TMM instances and the Linux host) and total memory usage.

Performance Tracking: In addition to CPU and memory, the dashboard displays other vital statistics such as total active connections, throughput (bits/packets per second), SSL transactions per second (TPS), and compression efficiency.

Operational Health: Monitoring these metrics from the dashboard allows the administrator to quickly identify performance trends or resource exhaustion that could impact the Control Plane or Data Plane stability.

Comparison to Other Menus:

Local Traffic > Virtual Servers: Provides statistics specific to traffic objects rather than global system resources.

Network > Interfaces: Shows physical layer statistics like link status, errors, and drops for specific ports.

Device Management > Overview: Focuses on high availability (HA) states, synchronization status, and device trust rather than granular performance metrics.

F5 architecture distinguishes between the Data Plane (TMM processing application traffic) and the Control Plane (Linux host processing management tasks). High Control Plane CPU utilization typically points to administrative activities such as heavy GUI usage, complex API calls (iControl), large-scale configuration synchronizations, or intensive logging/monitoring tasks rather than the actual switching or load balancing of application data.

In a BIG-IP Device Service Cluster (DSC), manual configuration synchronization is performed using the ConfigSync framework. The supported and documented command to manually push the local configuration to a specific device group is:

tmsh run cm config-sync to-group

This command:

Initiates a one-time manual ConfigSync

Pushes the local device’s configuration to all members of the specified device group

Is commonly used when auto-sync is disabled or when the administrator wants explicit control over synchronization timing

Why the other options are incorrect:

A is not a valid TMSH command for ConfigSync.

B enables auto-sync but does not perform an immediate synchronization.

D is not a valid or supported TMSH command for device group configuration synchronization.

Therefore, the correct command to manually synchronize configuration to a device group is C.

===========

Management connectivity is protected by an allowed access list for the httpd daemon. Unlike TMM data ports which use 'Port Lockdown' settings, the management port's access is controlled by a specific 'Allow' list. If an administrator's IP is not explicitly included in this list, the Control Plane will reject HTTPS connection attempts to the management utility.

On BIG-IP systems, Local Traffic Manager (LTM) is responsible for:

Pool and pool member management

Health monitor execution

Marking pool members UP or DOWN based on monitor results

Events related to health monitor status changes, including when pool members transition between UP and DOWN, are logged in /var/log/ltm.

Why the other options are incorrect:

/var/log/audit records administrative configuration changes, not runtime health status.

/var/log/secure logs authentication and authorization events.

/var/log/monitors is not a standard BIG-IP log file.

Therefore, the correct log file for pool member health monitor status events is /var/log/ltm.

===========

On BIG-IP systems that participate in a Device Service Cluster (DSC), each device compares the remote device’s system time to its own system time. If the difference is outside the ConfigSync time threshold (commonly referenced as 3 seconds by default), BIG-IP updates the shell prompt to show “Peer Time Out of Sync”, and ConfigSync operations may fail until time is corrected (typically by fixing NTP reachability/configuration, or in some cases adjusting the threshold). (cdn.studio.f5.com)

This message is specifically about time drift between peers in the trust domain/DSC—not basic reachability (so B is not what it means), and it does not prove which side is “correct” (so C is too specific). It also doesn’t directly mean an NTP source is “skewed” (A can be a cause, but the prompt message itself indicates the peer-to-peer time mismatch condition). (cdn.studio.f5.com)

On BIG-IP systems, authentication and authorization events are logged in /var/log/secure. This includes:

Successful and failed SSH login attempts

Invalid user authentication attempts

PAM (Pluggable Authentication Module) authentication failures

Access denials related to secure services

Why the other options are incorrect:

/var/log/messages contains general system messages and service events, not detailed authentication failures.

/var/log/audit records administrative configuration changes (who changed what and when), not login attempts.

/var/log/ltm logs traffic-management (TMM) and application-related events.

Therefore, the correct log file for investigating unauthorized SSH login attempts is /var/log/secure.

===========

Although /var/log/ltm is primarily associated with Local Traffic Manager events, it is also the primary destination for system-level alerts generated by the Control Plane's chmand (Chassis Manager Daemon). Hardware status changes, including power supply failures, fan speeds, and temperature warnings, are logged as "notice" or "critical" events within the LTM log file.

F5 Support uses a specific scale to categorize the urgency of technical issues, which helps the Control Plane management team prioritize resources effectively.

Severity 1 (Critical): Used for emergency situations where a production site is completely down, or there is a critical impact on business operations with no workaround available.

Severity 2 (High): Assigned when a system is severely degraded, or a primary function is significantly impacted, but the site remains operational in a degraded state.

Severity 3 (Medium): Applicable for issues where there is a partial loss of non-critical functionality, or the system is failing intermittently but the core business is not currently impacted.

Severity 4 (Low): This is the appropriate level for non-critical issues, general "how-to" questions, or maintenance planning. Since the administrator plans to resolve this issue in two weeks, it falls under the category of a low-priority maintenance task that does not require an immediate response from F5 support.

Comprehensive and Detailed Explanation From BIG-IP Administratio24n Control Plane Administration documents: TMOS Device Service Cluste25ring (DSC) allows for configuration changes to be made on any device within a synchronization group. If Auto-Sync is enabled, the Control Plane detects the change on the Standby unit and automatically propagates (pushes) that updated configuration to the other members of the HA pair

The audit log (/var/log/audit) records configuration changes made on the BIG-IP system, including:

Who made the change (user account)

What was changed (for example, a virtual server modification)

When the change occurred

How it was performed (GUI, TMSH, or API)

Why the other options are incorrect:

/var/log/secure logs authentication events such as login successes and failures, not configuration changes.

/var/log/ltm logs traffic-management and runtime LTM events, not administrative configuration modifications.

Therefore, the correct log file for tracking who changed a virtual server is /var/log/audit.

Traffic Groups are the mechanism BIG-IP uses to control which device owns specific application traffic in a high-availability (HA) configuration. When maintenance is required on a device that is currently active for a traffic group, the correct and recommended action is to fail over that traffic group to another device in the device group.

Failing over the traffic group moves ownership of that traffic group (and the virtual servers associated with it) to another available device without forcing the entire device into standby.

This allows targeted maintenance while minimizing impact to other traffic groups that may still be active on the device.

Why the other options are incorrect:

A is unnecessary and incorrect; traffic groups are not recreated for routine maintenance.

C forces the entire device to standby, which may move more traffic than intended.

D (Demote) affects device trust/priority behavior and is not the standard or recommended method for moving traffic group ownership.

Therefore, selecting the Traffic Group and choosing Failover is the correct solution.

A BIG-IP device group cannot be deleted if it still contains device members, even if one of those devices has already been decommissioned or is unreachable. Before deleting the device group, the administrator must explicitly remove the decommissioned device from the device group configuration.

Once the removed or unreachable device is deleted from the device group membership, the BIG-IP system allows the remaining administrator to successfully delete the device group.

Why the other options are incorrect:

A. Remove all members from the device groupThis is not required; the key requirement is removing the decommissioned device, not all members.

B. Make sure all members are in syncSynchronization status does not prevent device group deletion.

D. Disable the device groupDevice groups cannot be disabled; they must be modified or deleted.

Therefore, the correct prerequisite action is to remove the decommissioned device from the device group, making C the correct answer.

===========

Identifying the current device status includes knowing which software modules (such as LTM, ASM, or APM) are active and how much hardware resource (CPU/Memory) is allocated to them40404040. The System > Resource Provisioning screen displays the licensing status and allows the administrator to set the provisioning level (Nominal, Dedicated, or Minimum) for each module.

In F5 TMOS, a User Configuration Set (UCS) is the standard archive format used for backing up and migrating a complete system configuration .

Composition: A UCS file contains all necessary configuration data, including system-specific files, license information, SSL certificates, private keys, and local user accounts.

Procedural Use: When migrating to new hardware or performing an RMA replacement, the UCS file is the primary tool used to restore the entire Control Plane state to the new device.

Restoration: It can be managed through the Configuration Utility under System > Archives or via the CLI using the tmsh load /sys ucs command

The correct location to restrict management access to specific subnets is D. System > Platform1.

To determine the current failover (HA) status of a BIG-IP system using tmsh, F5 documentation explicitly states that the administrator should use the following command:

show /cm failover-status

This command displays:

The current failover state (active, standby, or offline)

Detailed failover status information

The operational HA condition of the device within a device group

According to F5 Knowledge Base Article K08452454, the documented procedure for checking failover status is:

Log in to the TMOS Shell (tmsh)

Run show /cm failover-status

Why the other options are incorrect:

A. list /cm failover shows configuration settings, not operational HA status.

B. show /sys failover is not the documented command for checking current failover status and does not align with F5’s recommended procedure.

When a failover occurs, the newly active device must inform the surrounding network that it now "owns" the shared IP addresses. Without MAC Masquerade, the new device uses its own hardware MAC, requiring upstream routers to update their ARP tables (which causes a delay). MAC Masquerading allows the HA pair to share a "floating" MAC address, ensuring the Control Plane transition is transparent to the network layer

The EUD is a 33hardware-level diagnostic tool that runs outside of the TMOS operating system. Because it is used when the system cannot boot or is in a pre-boot state, it cannot be accessed via the GUI or management network. The administrator must connect physically via the serial Console Port to interact with the boot menu and initiate the hardware tests.

Managing the license is a primary Control Plane task required to activate software modules and features on a BIG-IP device.

License Management Utility: All actions related to the device license, including initial activation, renewal, and adding add-on keys, are performed under the System > License section of the Configuration Utility.

Procedural Requirements: Licensing often requires the generation of a "dossier," which is a unique encrypted string used by the F5 License Server to generate the final license file.

Impact on Services: Updating or re-activating a license generally requires a restart of system services (such as the tmm daemon), which will temporarily disrupt traffic processing unless performed on a standby unit in a high availability pair.

Add-on Licenses: If an administrator needs to increase the capacity of a specific module (like increasing the SSL TPS limit or adding a new module like ASM), the new registration keys are entered through this same interface using the "Re-activate" button.