I85PREP
⌘ K
F5-301A study materials
F5-301A study resources

F5-301A practice questions

One question at a time. Build your F5-301A understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Setup and Initial Configuration

With factory-default settings, what IP address is assigned to the BIG-IP management interface?

  1. 192.168.0.245
  2. 172.16.1.245
  3. 192.168.1.245 Correct answer.
  4. 10.1.1.1

Explanation

A factory-default BIG-IP uses 192.168.1.245/24 on the management interface, with 192.168.1.1 as the default management gateway. Administrators can change this address through the LCD Setup menu, the console Setup utility, or the browser-based utility.

Question 2Setup and Initial Configuration

Which protocol and port does the browser-based Setup utility use by default on a new BIG-IP?

  1. SSH on TCP 22
  2. HTTP on TCP 80
  3. HTTPS on TCP 443 Correct answer.
  4. SNMP on UDP 161

Explanation

The Configuration utility is accessed over HTTPS on TCP 443, and HTTP is not the default management UI protocol. SSH and SNMP serve different management functions.

Question 3Setup and Initial Configuration

Which account is the default web administrator on a BIG-IP system?

  1. admin Correct answer.
  2. f5user
  3. bigip
  4. root

Explanation

The default administrative account for the Configuration utility is admin, and its initial password is set during setup. The root account exists for the underlying Linux shell and is not the normal web login.

Question 4Setup and Initial Configuration

What must be done for the LTM module before virtual servers can be configured?

  1. Provision the module Correct answer.
  2. Add a default route
  3. Create a trunk
  4. Assign a floating IP

Explanation

A licensed module must be provisioned before its configuration objects become available. Provisioning allocates resources and enables the module's menus and commands.

Question 5Setup and Initial Configuration

Which interface is dedicated to out-of-band management and kept separate from data-plane VLANs?

  1. VLAN 0
  2. TMM
  3. MGMT Correct answer.
  4. 1.1

Explanation

The MGMT interface carries management traffic such as HTTPS, SSH, and license activation. Data-plane interfaces such as 1.1 are assigned to VLANs and handled by TMM.

Question 6Setup and Initial Configuration

Which file holds the active BIG-IP configuration that is loaded at startup?

  1. /config/bigip.conf Correct answer.
  2. /etc/hosts
  3. /var/log/ltm
  4. /etc/network/interfaces

Explanation

The main configuration is stored in /config/bigip.conf and related files under /config. tmsh save sys config writes the running configuration to these files.

Question 7Setup and Initial Configuration

What is the role of a self IP address on a BIG-IP?

  1. It is a data-plane address on a VLAN Correct answer.
  2. It is the virtual server destination address
  3. It is the out-of-band management address
  4. It is the address used for license activation

Explanation

A self IP is a data-plane address associated with a VLAN, used for termination and for reaching pool members. Management and license traffic use the MGMT interface instead.

Question 8Setup and Initial Configuration

Which command shows configured NTP peers and their synchronization state?

  1. ifconfig -a
  2. ntpq -p Correct answer.
  3. ps aux
  4. route -n

Explanation

ntpq -p lists NTP peers, their stratum, and offset and reachability information. It is the standard query for verifying time synchronization.

Question 9Setup and Initial Configuration

A BIG-IP management address is 10.10.10.50/24, and the license server is at 203.0.113.10. Which object must be configured so management traffic can reach that server through 10.10.10.1?

  1. A VLAN group
  2. A data-plane self IP
  3. A SNAT pool
  4. A management route Correct answer.

Explanation

Traffic sourced from the management interface uses the management route table. A default management route pointing to 10.10.10.1 provides the path to remote networks.

Question 10Setup and Initial Configuration

Which tmsh command adds 10.0.0.123 as an NTP server?

  1. tmsh create net ntp server 10.0.0.123
  2. tmsh create sys management-route ntp 10.0.0.123
  3. tmsh modify sys dns name-servers add { 10.0.0.123 }
  4. tmsh modify sys ntp servers add { 10.0.0.123 } Correct answer.

Explanation

NTP servers are configured under sys ntp, and the servers list is modified with the add clause. The syntax uses braces around the address list.

Question 11Setup and Initial Configuration

When automatic license activation is unavailable, which item is generated on the BIG-IP and sent to F5 to obtain a license file?

  1. A dossier Correct answer.
  2. A UCS archive
  3. A CSR
  4. A qkview

Explanation

The dossier collects platform and registration information needed by F5 to issue a license. It is submitted through the F5 license portal when manual activation is used.

Question 12Setup and Initial Configuration

Which relationship must exist before two BIG-IP devices can synchronize configuration as an active/standby pair?

  1. A DNS zone and resolver
  2. A SNAT pool and pool member
  3. A VLAN group and trunk
  4. A trust domain and device group Correct answer.

Explanation

Configuration synchronization requires the devices to trust each other and to be members of the same device group. The trust domain establishes secure communication, and the device group defines what is synchronized.

Question 13Setup and Initial Configuration

After changes are made with tmsh, which command writes the running configuration to the configuration files?

  1. tmsh reset sys config
  2. tmsh merge sys config
  3. tmsh load sys config
  4. tmsh save sys config Correct answer.

Explanation

tmsh save sys config persists the running configuration to /config/bigip.conf and related files. Without saving, changes may not survive a restart.

Question 14Setup and Initial Configuration

Which setting lets the management interface resolve hostnames used for license activation and NTP?

  1. A wide IP
  2. Management DNS name servers Correct answer.
  3. A DNS resolver on a data-plane VLAN
  4. A pool member

Explanation

Management DNS servers are configured under sys dns and are used by management services. Data-plane DNS resolver settings apply to DNS traffic handled by TMM, not management lookups.

Question 15Setup and Initial Configuration

An interface connects to an 802.1Q trunk carrying VLAN 100. How should VLAN 100 be configured on the BIG-IP?

  1. As a self IP without a VLAN
  2. As a management route
  3. As a tagged VLAN on the interface Correct answer.
  4. As an untagged VLAN on the interface

Explanation

When the switch port is a trunk using 802.1Q, the BIG-IP VLAN must be tagged with the matching VLAN ID on the interface. An untagged VLAN would expect native or untagged frames.

Question 16Setup and Initial Configuration

What does provisioning a module at the Nominal level do?

  1. It shares resources with other modules Correct answer.
  2. It receives all available memory
  3. It cannot be licensed
  4. It is disabled until reboot

Explanation

Nominal provisioning allocates a standard share of resources and allows other modules to coexist. Dedicated provisioning is used when one module should receive maximum resources.

Question 17Setup and Initial Configuration

What is the default route domain ID on a BIG-IP?

  1. 1
  2. 255
  3. 0 Correct answer.
  4. 100

Explanation

Route domain 0 is the default and is used when an address has no route-domain suffix. Additional route domains isolate routing tables.

Question 18Setup and Initial Configuration

Which service must be running for the browser-based Setup utility to be reachable over HTTPS?

  1. httpd Correct answer.
  2. snmpd
  3. ntpd
  4. sshd

Explanation

The BIG-IP management web service is provided by the httpd process. If httpd is not running, the browser-based Configuration utility cannot be reached even if the management address is correct.

Question 19Setup and Initial Configuration

What is the default serial console baud rate on a BIG-IP hardware platform?

  1. 38400
  2. 115200
  3. 9600 Correct answer.
  4. 19200

Explanation

F5 hardware platforms use 9600 baud, 8 data bits, no parity, and 1 stop bit by default for the serial console. This setting must match the terminal client.

Question 20Setup and Initial Configuration

Can a module be provisioned before its license is installed?

  1. No, provisioning requires a self IP
  2. Yes, if the module is in a device group
  3. No, the module must be licensed first Correct answer.
  4. Yes, provisioning activates the license

Explanation

Provisioning enables a licensed module; it does not install or activate a license. The license must be present before the provision level can be raised.

Question 21Setup and Initial Configuration

Which provisioning level gives a module the maximum hardware resources and limits other modules from using those resources?

  1. None
  2. Dedicated Correct answer.
  3. Minimum
  4. Nominal

Explanation

Dedicated provisioning allocates the module's maximum resources and can prevent other modules from using them. Nominal shares resources, Minimum uses the least, and None disables the module.

Question 22Setup and Initial Configuration

Which command displays the BIG-IP license status and licensed modules?

  1. tmsh show sys version
  2. tmsh show sys provisioning
  3. tmsh show sys hardware
  4. tmsh show sys license Correct answer.

Explanation

tmsh show sys license reports license state, active modules, and service check dates. Version, hardware, and provisioning commands show different information.

Question 23Setup and Initial Configuration

Which address is used as the source for an automatic license activation request by default?

  1. The management IP Correct answer.
  2. The floating self IP
  3. The default route domain address
  4. The first self IP

Explanation

License activation is management traffic and is sourced from the management interface address. It follows the management route table to reach the F5 license server.

Question 24Setup and Initial Configuration

A self IP is configured as 10.10.10.20%4. Which route domain does this address belong to?

  1. 1
  2. 0
  3. 4 Correct answer.
  4. 3

Explanation

The percent sign introduces the route domain ID, so %4 places the address in route domain 4. Without a suffix, the address would be in route domain 0.

Question 25Setup and Initial Configuration

Which command checks the BIG-IP configuration syntax without applying the configuration?

  1. tmsh save sys config
  2. tmsh merge sys config
  3. tmsh load sys config default
  4. tmsh load sys config verify Correct answer.

Explanation

tmsh load sys config verify parses the configuration files and reports syntax errors without loading them into the running system. Using load sys config default restores defaults, and save persists the running configuration.

Question 26Setup and Initial Configuration

A BIG-IP must run both LTM and ASM. ASM requires only a small amount of memory, and the administrator wants to leave as much capacity as possible for LTM. Which provisioning level should be selected for ASM?

  1. Nominal
  2. Maximum
  3. Minimum Correct answer.
  4. None

Explanation

Provisioning levels control how much memory and CPU a module can use. Minimum enables the module with the smallest resource allocation, whereas Nominal and Maximum reserve progressively more. None would disable ASM, so it would not meet the requirement to run ASM.

Question 27Network Configuration (VLANs, Self IPs, Routes)

On a BIG-IP, what does a VLAN primarily define?

  1. A certificate store used by client SSL profiles
  2. A Layer 2 broadcast domain for interfaces and self IPs Correct answer.
  3. A group of pool members that receive client traffic
  4. A Layer 3 next-hop table for outbound traffic

Explanation

A VLAN groups interfaces into the same Layer 2 broadcast domain, and self IPs are assigned to that VLAN. Routing decisions and pool selection are handled by separate configuration objects. The VLAN does not define a certificate store or a pool.

Question 28Network Configuration (VLANs, Self IPs, Routes)

A self IP address on BIG-IP is best described as which of the following?

  1. The destination IP of a standard virtual server
  2. An address assigned to a pool member node
  3. A range of addresses used for source NAT
  4. An IP address owned by the BIG-IP on a VLAN Correct answer.

Explanation

A self IP is an address owned by the BIG-IP on a VLAN; it is used for termination, HA, and device communication. Virtual server destination addresses and pool member addresses are separate objects. SNAT pools contain translation addresses, not self IPs.

Question 29Network Configuration (VLANs, Self IPs, Routes)

Which route represents the default route on a BIG-IP?

  1. 192.168.1.0/24
  2. 10.0.0.0/8
  3. 255.255.255.255/32
  4. 0.0.0.0/0 Correct answer.

Explanation

The route 0.0.0.0/0 matches every destination and is used when no more specific route exists. 10.0.0.0/8 and 192.168.1.0/24 are specific networks, and 255.255.255.255/32 is a host route. BIG-IP selects the most specific matching route.

Question 30Network Configuration (VLANs, Self IPs, Routes)

What distinguishes a tagged VLAN from an untagged VLAN on BIG-IP?

  1. Tagged VLANs add an 802.1Q VLAN header Correct answer.
  2. Tagged VLANs require a floating self IP
  3. Tagged VLANs carry only IPv6 traffic
  4. Tagged VLANs use GRE tunnels

Explanation

A tagged VLAN inserts an 802.1Q header carrying the VLAN ID so multiple VLANs can share a link. An untagged VLAN sends frames without that header. Tagging is independent of GRE, IP version, or floating self IPs.

Question 31Network Configuration (VLANs, Self IPs, Routes)

An interface is assigned to a VLAN. What must be true to place a second VLAN on that same interface?

  1. At least one of the VLANs must use tagging Correct answer.
  2. The interface must be configured as a trunk port on BIG-IP only
  3. Both VLANs must use the same tag value
  4. A route domain must be created for each VLAN

Explanation

A single interface can belong to multiple VLANs only when the additional VLANs are tagged, because the 802.1Q tag identifies the VLAN. One VLAN may be untagged as the native VLAN on that interface. Both VLANs cannot use the same tag on one interface.

Question 32Network Configuration (VLANs, Self IPs, Routes)

What does the Port Lockdown setting on a self IP control?

  1. Which routes are advertised from the self IP
  2. Which service ports accept traffic to the self IP Correct answer.
  3. Which pool members may receive traffic from the self IP
  4. Which VLANs may use the self IP as a default gateway

Explanation

Port lockdown is a self IP property that restricts which TCP/UDP ports can reach BIG-IP services through that address. It does not choose VLANs, pool members, or advertised routes. The setting is commonly used to limit management access.

Question 33Network Configuration (VLANs, Self IPs, Routes)

Why is a floating self IP commonly configured on a BIG-IP pair?

  1. To provide a separate address for every pool member
  2. To provide an address that follows the active device Correct answer.
  3. To encrypt traffic between VLANs
  4. To create a dedicated route domain for HA traffic

Explanation

A floating self IP is owned by the active device in an HA pair and moves to the peer during failover. It gives clients and peers a stable address. It does not provide per-member addresses, encryption, or a separate route domain.

Question 34Network Configuration (VLANs, Self IPs, Routes)

What is the main purpose of a route domain on BIG-IP?

  1. To load balance DNS queries across pools
  2. To separate Layer 3 address spaces and routes Correct answer.
  3. To isolate Layer 2 broadcast traffic between VLANs
  4. To compress traffic on WAN links

Explanation

A route domain creates a separate Layer 3 address space and routing table, which allows overlapping subnets and independent routes. Layer 2 isolation is provided by VLANs. Route domains are not for DNS load balancing or WAN compression.

Question 35Network Configuration (VLANs, Self IPs, Routes)

A VLAN must use 802.1Q tag 100 on interface 1.1. Which configuration meets this requirement?

  1. Create a self IP with name vlan100 on interface 1.1
  2. Assign interface 1.1 as untagged and set the VLAN ID to 100
  3. Assign interface 1.1 to the VLAN and set its tag to 100 Correct answer.
  4. Add interface 1.1 to a route domain with ID 100

Explanation

To carry 802.1Q tag 100, the interface assigned to the VLAN must be configured as tagged with tag 100. An untagged interface sends frames without an 802.1Q header. Self IP names and route domain IDs do not set VLAN tags.

Question 36Network Configuration (VLANs, Self IPs, Routes)

Interface 1.2 carries VLAN A untagged and VLAN B tagged with tag 20. How should the interfaces be configured?

  1. VLAN A tagged with tag 20 and VLAN B untagged on 1.2
  2. Both VLANs tagged, with VLAN A using tag 1
  3. Both VLANs untagged on 1.2
  4. VLAN A untagged on 1.2 and VLAN B tagged with tag 20 on 1.2 Correct answer.

Explanation

On one interface, one VLAN can be untagged as the native VLAN while other VLANs are tagged with unique 802.1Q tags. VLAN A should therefore be untagged on 1.2, and VLAN B should be tagged with tag 20. Both VLANs cannot be untagged on the same interface.

Question 37Network Configuration (VLANs, Self IPs, Routes)

What does the netmask on a self IP such as 10.0.0.10/24 define?

  1. The maximum number of pool members
  2. The directly connected subnet for that self IP Correct answer.
  3. The route domain ID assigned to the address
  4. The VLAN tag used for outbound traffic

Explanation

The netmask on a self IP defines the directly connected subnet, which BIG-IP installs as a connected route. Traffic to addresses in that subnet is sent on the linked VLAN. The mask does not set VLAN tags, route domain IDs, or pool limits.

Question 38Network Configuration (VLANs, Self IPs, Routes)

A static route sends 10.20.0.0/16 to gateway 192.168.5.1. What must generally be true for BIG-IP to use that gateway?

  1. The gateway must be in a different route domain than the route
  2. The gateway must be reachable on a directly connected subnet Correct answer.
  3. The gateway must be a pool member in a virtual server
  4. The gateway must be reachable through a VLAN with no self IP

Explanation

A static route's gateway must be reachable on a directly connected subnet, normally through a self IP on a VLAN. BIG-IP cannot use a next hop that it does not know how to reach. Pool membership and route domain separation do not make a gateway reachable.

Question 39Network Configuration (VLANs, Self IPs, Routes)

How is route domain 4 represented in an IP address on BIG-IP?

  1. 10.1.1.10#4
  2. 10.1.1.10:4
  3. 10.1.1.10%4 Correct answer.
  4. 10.1.1.10/4

Explanation

BIG-IP appends %ID to an address to identify its route domain; 10.1.1.10%4 means 10.1.1.10 in route domain 4. A slash introduces a prefix length, and a colon usually introduces a port. The # character is not the route domain separator.

Question 40Network Configuration (VLANs, Self IPs, Routes)

What is the effect of enabling VLAN failsafe on a VLAN?

  1. It assigns a floating self IP to every interface in the VLAN
  2. It automatically tags all frames on the VLAN
  3. It monitors VLAN traffic and can trigger failover Correct answer.
  4. It prevents the VLAN from carrying untagged traffic

Explanation

VLAN failsafe monitors the VLAN for traffic and can take an action such as failover or restart when traffic stops. It does not change tagging or assign addresses. It is a health mechanism for the VLAN.

Question 41Network Configuration (VLANs, Self IPs, Routes)

Two devices on the same VLAN must exchange 1600-byte frames. What should be configured on the BIG-IP VLAN?

  1. A VLAN MTU of at least 1600 Correct answer.
  2. A larger SNAT pool address range
  3. A larger port lockdown setting
  4. A larger self IP subnet mask

Explanation

The VLAN MTU controls the largest frame BIG-IP can send or receive on that VLAN. To pass 1600-byte frames without fragmentation, the VLAN MTU must be at least 1600. Port lockdown and subnet masks do not change frame size.

Question 42Network Configuration (VLANs, Self IPs, Routes)

A self IP is created as 10.0.0.10%2. What does the %2 indicate?

  1. It uses VLAN tag 2
  2. It has HA priority 2
  3. It listens only on port 2
  4. It is in route domain 2 Correct answer.

Explanation

The %2 suffix places the address in route domain 2, so the self IP belongs to that Layer 3 partition. VLAN tags and HA priorities use separate settings. The suffix does not restrict the address to a service port.

Question 43Network Configuration (VLANs, Self IPs, Routes)

BIG-IP has routes for 10.1.0.0/16 and 10.1.5.0/24. Which route is chosen for destination 10.1.5.25?

  1. 10.1.0.0/16 because it is shorter
  2. 10.1.5.0/24 by longest prefix match Correct answer.
  3. The route with the lowest gateway
  4. The route with the highest route domain ID

Explanation

BIG-IP uses longest prefix match, so 10.1.5.0/24 is preferred over 10.1.0.0/16 for 10.1.5.25. More specific routes take precedence regardless of gateway address or route domain ID. The /16 route would be used only if the /24 route were absent.

Question 44Network Configuration (VLANs, Self IPs, Routes)

Two self IPs on the same VLAN are 192.168.10.10/24 and 192.168.20.10/24. What is the result?

  1. Each self IP is in a different subnet on the same VLAN Correct answer.
  2. Both self IPs are placed in one subnet automatically
  3. The second self IP is rejected because a VLAN supports one subnet
  4. The VLAN is split into two broadcast domains

Explanation

Each self IP carries its own netmask, so the two addresses can represent different directly connected subnets on the same VLAN. The VLAN remains one Layer 2 broadcast domain. BIG-IP does not reject the second subnet merely because it is on the same VLAN.

Question 45Network Configuration (VLANs, Self IPs, Routes)

A default route is needed only for traffic in route domain 7. Which configuration is appropriate?

  1. Create a route to 0.0.0.0/0%7 Correct answer.
  2. Create a route and assign it to VLAN 7
  3. Create a route with gateway 0.0.0.0%7
  4. Create seven routes and enable ECMP

Explanation

A route destined for 0.0.0.0/0%7 applies only to route domain 7's default traffic. The %7 suffix on the destination places the route in that route domain. A gateway of 0.0.0.0 is not a valid next hop.

Question 46Network Configuration (VLANs, Self IPs, Routes)

What is a VLAN group on BIG-IP used for?

  1. To apply one port lockdown setting to several VLANs
  2. To assign several self IP addresses to a single VLAN
  3. To combine multiple static routes behind one default gateway
  4. To provide Layer 2 redundancy across interfaces or devices Correct answer.

Explanation

A VLAN group associates VLANs so that their Layer 2 connectivity can fail over between interfaces or devices. It does not bundle self IPs, routes, or port lockdown settings. It is an HA mechanism for VLAN-level redundancy.

Question 47Network Configuration (VLANs, Self IPs, Routes)

Two departments both use 10.10.0.0/24. Which design allows both to coexist on one BIG-IP?

  1. Place both subnets on one VLAN with different names
  2. Assign both subnets to one self IP with two masks
  3. Use a separate route domain for each subnet Correct answer.
  4. Use one route domain with two default gateways

Explanation

Route domains allow the same private subnet to be reused in separate Layer 3 partitions; addresses in each domain are written with a %ID suffix. Separate names on one VLAN or multiple default gateways in one route domain do not resolve duplicate addresses. A single self IP cannot hold two netmasks for this purpose.

Question 48Network Configuration (VLANs, Self IPs, Routes)

In an active/standby pair, how does a floating self IP behave during normal operation?

  1. It remains inactive until a virtual server references it
  2. It is active on the standby device until failover
  3. It is active on both devices at the same time in the pair
  4. It is active on the active device and moves on failover Correct answer.

Explanation

A floating self IP is active on the active unit and is taken over by the peer when failover occurs. It is not simultaneously active on both units, and it is not held on standby during normal operation. It does not wait for a virtual server to reference it.

Question 49Network Configuration (VLANs, Self IPs, Routes)

Interface 1.1 is already assigned untagged to VLAN A. An attempt is made to assign it untagged to VLAN B. What happens?

  1. VLAN B automatically becomes a tagged VLAN
  2. Both VLANs share the interface without tags
  3. The interface is moved to VLAN B automatically
  4. The second untagged assignment is rejected Correct answer.

Explanation

An interface can have only one untagged VLAN; additional VLANs on that interface must use 802.1Q tags. A second untagged assignment is therefore invalid. BIG-IP does not automatically tag the new VLAN or move the interface without an explicit configuration change.

Question 50Network Configuration (VLANs, Self IPs, Routes)

What does strict isolation in a route domain enforce?

  1. It prevents the route domain from using tagged VLANs
  2. It prevents traffic from crossing into other route domains without translation Correct answer.
  3. It allows traffic to cross route domains without NAT
  4. It forces all self IPs to use port lockdown Allow None

Explanation

Strict isolation prevents traffic from crossing route domain boundaries without address translation or another supported transition method. It does not affect VLAN tagging or port lockdown. Without strict isolation, a parent route domain can provide connectivity.