F5 Networks F5CAB1 Exam Questions

BIG-IP module provisioning determines how CPU, memory, and disk resources are allocated to each licensed module. F5 defines a specific set of supported provisioning levels.

Valid provisioning (resource allocation) settings

Nominal

Allocates a standard, balanced amount of system resources to a module.

Intended for typical production deployments where multiple modules may be provisioned at the same time.

Dedicated

Allocates all available system resources to a single module.

Used when the BIG-IP device is dedicated to running only one module (for example, ASM-only or APM-only deployments).

No other modules can be provisioned when one is set to Dedicated.

These two options are valid and supported provisioning levels.

Why the other options are incorrect

Maximum

This is not a valid BIG-IP provisioning level.

BIG-IP does not use ''Maximum'' as a resource allocation setting.

Limited

This is also not a supported provisioning level.

BIG-IP uses levels such as None, Minimal, Nominal, and Dedicated (module-dependent), not Limited.

Provisioning settings define which modules are enabled and how system resources are allocated to them.

These provisioning declarations are stored in:

/config/bigip.conf

This file contains:

Full module provisioning statements

TMSH-equivalent provisioning configurations such as:

sys provision ltm { level nominal }

sys provision asm { level nominal }

It is the primary system configuration file that stores all active provisioning details.

Why the other answers are incorrect

A . /config/bigip.license

Shows licensed modules, not provisioned modules.

B . /config/bigip_base.conf

Stores base networking (VLANs, Self-IPs, routes), not provisioning.

D . config.ucs

A backup archive, not a live configuration file.

Thus, the correct file to review active module provisioning is /config/bigip.conf.

The BIG-IP system has built-in licensing enforcement.

If an administrator provisions a module that the device is not licensed to run, the system will still allow the provisioning action to occur initially, but the system detects the mismatch and displays an alert.

What actually happens:

The GUI places a warning banner in the upper-left corner labeled something similar to:

''Provisioning Warning''

This appears immediately after provisioning a module that is not included in the active license.

The system remains in an ''inconsistent state'' until the module is disabled again or the license is updated.

This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.

Why the other options are incorrect:

A . ''A BIG-IP does not allow unlicensed modules to be provisioned.''

Not true. BIG-IP does allow provisioning, but warns afterward.

B . ''A warning will appear when provisioning an unlicensed module.''

The warning does not appear during the provisioning step itself.

It appears after provisioning, in the main GUI, as a system banner.

A newly deployed BIG-IP Virtual Edition (VE) in VMware requires initial configuration of its management-ip address so it can be accessed over the network. F5 provides several valid mechanisms during initial console access:

A . Running the config utility

The config script is available on new BIG-IP installations and VE deployments.

It launches a guided text-based wizard allowing configuration of:

Management IP

Netmask

Default route

This is a standard and recommended method during first-time setup.

B . Using TMSH with create sys management-ip

Administrators can enter TMSH directly from the console and run:

create sys management-ip <ip>/<mask>

The management-ip object resides under sys, not under ltm or any other module.

This is the correct tmsh method for defining the management interface address.

Why the other options are incorrect:

C . create ltm management-ip

There is no such object under /ltm.

LTM handles traffic objects (virtual servers, pools), not system management interfaces.

D . Running the setup command

The setup command is used for general system configuration but does not configure the management-ip.

It is not the supported method for initial management IP assignment on VE deployments.

Therefore, the valid methods are running the config utility and using the sys management-ip command within TMSH.

Port Lockdown controls which ports and protocols a Self IP will respond to.

The Allow Default setting permits only a predefined set of BIG-IP internal and required service ports.

The Allow Default list includes:

TCP 443 HTTPS (Management/TMUI access via Self-IP)

TCP 4353 CMI (device sync)

TCP/UDP ports related to HA communication

Other essential internal F5 ports

Why TCP 443 is correct:

It is one of the officially allowed ports under Allow Default.

It enables HTTPS/TMUI access through a Self IP.

Why the other options are incorrect:

A . TCP 80 (HTTP)

Not allowed under Allow Default

HTTP via Self-IP is blocked unless placed under Allow Custom

B . UDP 8443

Not an F5 default service

Not part of the Allow Default ports