[Q21-Q35] Updated Jul-2026 Exam Engine or PDF for the F5 F5CAB1 test to help you quickly prepare for the F5 exam!

Setting up SSL certificates is typically done after the initial setup, not during it. The main tasks during initial setup involve network configuration and licensing.

BIG-IP hardware platforms use chassis LEDs to indicate system health states.
A solid yellow status LED typically indicates a warning condition, such as:
A non-critical hardware alert
A temperature threshold nearing limit
A minor fan or sensor irregularity
Other non-fatal environmental or system conditions
This state reflects a warning-level alarm, meaning the unit is operational but requires investigation.

BIG-IP allocates CPU and memory resources based on module provisioning levels.
To view how much CPU a module is assigned, administrators must check provisioning information from:
C). GUI — System » Resource Provisioning
This page visually displays CPU allocation via color-coded bars.
Hovering over the CPU bar shows:
CPU usage percent per module
Which modules share CPU cycles
The system’s total resource allocation
This is the primary GUI method.
D). tmsh show /sys provision
This command displays detailed module provisioning information including:
Provisioned modules
Their provisioning level
CPU and memory allocation data
It is the authoritative CLI method for resource provisioning status.

BIG-IP allocates CPU and memory resources based on module provisioning levels.
To view how much CPU a module is assigned, administrators must check provisioning information from:
C). GUI – System > Resource Provisioning
This page visually displays CPU allocation via color-coded bars.
Hovering over the CPU bar shows:
* CPU usage percent per module
* Which modules share CPU cycles
* The system’s total resource allocation
This is the primary GUI method.
D). tmsh show /sys provision
This command displays detailed module provisioning information including:
* Provisioned modules
* Their provisioning level
* CPU and memory allocation data
It is the authoritative CLI method for resource provisioning status.
Why the other options are incorrect:
A). top
* Shows real-time process usage, not provisioned CPU allocation.
B). tmsh show /sys cpu
* Displays CPU runtime utilization, not per-module provisioning.
E). Statistics Dashboard
* Only shows traffic / system runtime metrics, not provisioning resource allocations.
Therefore, C and D are correct.

TheService Check Datedetermines whether a particular software version is allowed to run under the device’s license.
* When installing or upgrading TMOS, the installer checks theService Check Datestored in the BIG-IP license file.
* If the license date isolderthan the minimum required for the target version, the software installation is blocked.
* This check happensspecifically during a software install, not during routine device operations.
Editing virtual servers or system startup do not trigger this validation.
Thus, the enforcement happensduring software installation.

To understand:
Which modules are licensed
Which modules are provisioned
The resource requirements (CPU / RAM) of each module
The administrator uses:
System » Resource Provisioning
This page displays:
All modules present in the license
Whether they are enabled or disabled
Required memory to activate each module
CPU and disk allocation information
Provisioning level options (None / Minimal / Nominal / Dedicated)
This is the exact location where BIG-IP administrators evaluate module capacity before enabling or purchasing licensing upgrades.

The exhibit shows the configuration of a Self IP with:
* Port Lockdown: Allow Custom
* A Custom List that includes the following TCP ports:
* 443
* 22
Meaning of these ports:
* TCP 443 # HTTPS (TMUI – web-based management)
* TCP 22 # SSH (command-line remote access)
No other TCP, UDP, or protocol entries are listed; therefore, only these two services are allowed to reach the BIG-IP via this Self IP.
Evaluating the answer choices:
Option
Service
Port
Allowed?
FTP
TCP 21
Not listed
Not allowed
SSH
TCP 22
Listed
Allowed
Telnet
TCP 23
Not listed
Not allowed
Thus, SSH is the only traffic permitted through this Self IP configuration.

Securing the BIG-IP management interface is a fundamental administrative responsibility. F5 best practices emphasize restricting who can reach the management port and ensuring that only authorized systems are allowed access.
A). Limiting management access to trusted network segments
F5 recommends placing the management interface on adedicated, isolated, and secured management network or VLAN, rather than exposing it to production or untrusted networks.
This reduces the attack surface by ensuring only trusted segments have visibility to administrative interfaces.
D). Restricting management access by IP or subnet
F5 BIG-IP uses the/sys httpd allowlist (for HTTPS) and configuration options insshd(for SSH) to control which IP addresses or subnets can access the device.
By specifying only known administrative IPs or ranges, unauthorized users cannot reach the login services.
Why the other options are incorrect
B). Blocking all management HTTPS/SSH ports
* This would prevent any administrative access and is not a viable security practice.
C). Using Self-IP addresses for administrative access
* F5 explicitly warns against using Self-IPs for management access unless strictly necessary.
* Self-IPs are exposed to the data plane and should not be used as the primary administrative interface.

When a TMOS ISO file is transferred to/shared/images/, the BIG-IP automatically performs a validation step:
Checksum Verification
* Before the image becomes visible in the GUI, the systemverifies the internal checksumembedded inside the ISO.
* This ensures:
* The file was fully transferred
* The image is not corrupted
* It matches the official F5 release signature
* Only after passing this verification does the GUI display the ISO under “Available Images.” Why the other options are incorrect:
A). Reboot into a new partition
* No reboot occurs simply from uploading an image.
C). Copying into /var/local/images/
* This directory isnotused for ISO storage.
* All valid images remain in/shared/images/.
Thus, the correct system action ischecksum verification.

BIG-IP provisioning determines how CPU, memory, and disk resources are allocated to each module. The goal is to provision only the modules required and at levels appropriate to their performance needs.
Requirements in the question
The device will be used for:
* LTM(Local Traffic Manager) # load balancing
* ASM(Application Security Manager) # WAF
No functions require:
* APM (Access Policy Manager)
* AFM (Advanced Firewall Manager)
Why Option C is correct
Provisioning bothLTMandASMatNominallevel provides:
* Adequate performance for production load
* Plentiful system resources while avoiding dedicating the entire system to a single module
* Balanced allocation without starving memory or CPU
SettingAPM: NoneandAFM: Noneensures unused modules consume zero resources.
Why the other options are incorrect
A). Dedicated provisioning for both LTM and ASM
* Two modules cannot both run in “Dedicated” mode.
* Dedicated mode allocatesallresources to a single module – the second module cannot be dedicated simultaneously.
B). LTM and ASM both Dedicated
* Same issue: only one module can be Dedicated at a time.
* Also unnecessary for load balancing + WAF.
D). Setting APM and AFM to Minimal
* Minimal still consumes memory and CPU.
* Unused modules should be set toNone.
Therefore,Option Cis the best provisioning strategy.

Comprehensive and Detailed Explanation (Paraphrased from F5 BIG-IP Administration Install, Initial Configuration, and Upgrade concepts) When performing a TMOS upgrade, F5 recommends validating the target software version to ensure that the release does not contain defects that may impact system behavior. The upgrade preparation process includes checking for known issues, validating compatibility, and reviewing advisory information for the intended version. Two primary F5 tools serve this purpose:
B). F5 iHealth
iHealth is a cloud-based diagnostic and analysis platform used to evaluate the operational state of a BIG-IP system.
Administrators upload a QKView file to iHealth to receive an automated assessment of the system. As part of upgrade planning, iHealth provides:
* Version-specific issue analysis, comparing the system’s configuration and hardware against F5’s internal catalog of published issues.
* Upgrade advisories, identifying potential risks such as deprecated features, module compatibility concerns, or changes in behavior between TMOS versions.
* Checks against known defects, allowing administrators to determine whether the target TMOS version contains issues relevant to their deployment.
This aligns with F5’s recommended upgrade workflow, where iHealth is used before upgrading to confirm system readiness and detect software-level concerns.
D). F5 Bug Tracker
The Bug Tracker is F5’s dedicated interface for reviewing software defects across TMOS releases.
It enables administrators to:
* Search forknown bugs by TMOS version, module, severity, or defect ID.
* Review thestatus of defects(open, resolved, fixed in later releases).
* Identify whether high-impact or security-related issues are associated with the target upgrade version.
F5 documentation emphasizes reviewing known defects prior to installation of new software images, making the Bug Tracker a critical resource for upgrade validation.
Why the other options are not correct
A). F5 End User Diagnostics (EUD)
EUD is used exclusively forhardware diagnostics(ports, memory, fans). It does not provide software-related issue verification and is not used for upgrade planning.
C). F5 University
This is atraining platform, not an operational tool. It does not provide defect listings or upgrade-specific warnings.
E). F5 Downloads
Although it provides access to software images and release notes, it isnot a tool for identifying known bugs.
Release notes summarize general fixes and features, but systematic bug verification requires iHealth or the Bug Tracker.

The exhibit shows aSelf IPwith:
* VLAN:Data
* Port Lockdown:Allow None
Impact of “Allow None” on SNMP
When a Self IP is configured with:
Port Lockdown: Allow None
the BIG-IP blocksallservices and ports except a few hardcoded HA communication ports.
This means:
* UDP/161 (SNMP)is blocked
* UDP/162 (SNMP traps)is blocked
* The SNMP server cannot poll or receive data from the BIG-IP through this Self IP SNMP relies on access through the Self IP if out-of-band (mgmt interface) is not used.
Thus, the issue is directly caused byPort Lockdown = Allow None, which prevents SNMP communication.
Why the other options are incorrect:
B). Traffic Group must use a floating Traffic Group
* SNMP polling doesnotrequire floating Self IPs.
* Floating groups apply to HA failover IPs, not SNMP functionality.
C). VLAN/Tunnel must allow All VLANs
* Self IPs are always bound to a VLAN; SNMP doesnotrequire All VLANs.
* As long as the Self IP belongs to a reachable VLAN, SNMP can work.
D). Configuration is correct
* It is not correct:Allow Noneblocks SNMP and is the problem.

Provisioning defines how BIG-IP allocates system resources to modules.
The provisioning levels include:
* Dedicated – allocates all CPU, memory, and disk resources to a single module
* Nominal – standard resource allocation balanced with other modules
* Minimal – lowest level, used for basic utility needs
* None – module disabled
* Comprehensive / Maximal – not valid TMOS provisioning levels
Why “Dedicated” is correct
When a BIG-IP device is intended to run only ASM (Web Application Firewall), the recommended way to maximize performance is to provision the module at Dedicated level.
With ASM: Dedicated :
* ASM receives the entire hardware capacity
* No other modules can or should be provisioned
* This is explicitly recommended when a device is used solely as a WAF platform Why other options are incorrect B). Comprehensive / C. Maximal
* These are not valid provisioning modes in BIG-IP.
* TMOS supports: Nominal, Minimal, Large (module-specific), and Dedicated.
D). Nominal
* Shares resources with other modules
* Does not provide full system performance
* Not suitable when exclusive resource allocation is required
Thus, Dedicated is the correct provisioning choice.

The “Software Management” section in the Configuration utility is used to upload and apply new software images to the BIG-IP system.

To identify which boot volume is currently active on a BIG-IP system, the correct command is:
tmsh show sys software status
This command displays:
All installed boot volumes (HD1.1, HD1.2, HD1.3, etc.)
The BIG-IP software version installed on each volume
The Active field, indicating which volume the system is currently booted from The installation status (“complete”, “in-progress”, “allowed”) This is the standard and authoritative way to determine the active boot location.