I85PREP
⌘ K
F5-401 Security Expert study materials
F5-401 Security Expert study resources

F5-401 Security Expert: Security Deployment, Operations and Troubleshooting on BIG-IP and Distributed Cloud

F5-401 Security Expert · Work through your exam, one topic at a time.

All guide sections

Security Deployment, Operations and Troubleshooting on BIG-IP and Distributed Cloud

What the domain tests

How security services are deployed repeatably and how failures are isolated quickly across BIG-IP and F5 Distributed Cloud, without changing five variables at once and hoping.

Core rules

  • Declarative deployment. iControl REST drives automation; AS3 declares application services, DO declares ASM/WAF policy, and TS handles telemetry. Because declarations are the source of truth, manual tmsh changes are overwritten at the next deploy - a frequent post-incident surprise.
  • Backup and evidence. UCS archives capture configuration; qkview captures diagnostics and should be taken before restarts or failovers destroy state.
  • High availability. Device groups, traffic groups and floating self IPs govern failover; verify config sync direction and cm state rather than assuming synchronization succeeded.
  • Distributed Cloud structure. Regional and customer-edge sites, virtual sites, and a service graph of load balancer, WAF, bot defense and origin pool. Health checks, origin TLS with correct SNI, and route advertisement are the usual failure points.
  • Layer isolation. Work outward: L1-L4 (VLAN, self IP, route, ARP, SNAT and asymmetric routing), TLS handshake (version, cipher, chain, SNI), HTTP (Host header, pool member health), then security policy (WAF request log and support ID, APM session variables and logs), then platform metrics.

Worked example

Users report 502 errors after a change. The Distributed Cloud service graph shows the origin pool unhealthy. Testing from the customer edge with curl shows the origin requires TLS with a specific SNI, but the health check sends none, so every probe fails and the pool is marked down. Adding the correct SNI to the health check and origin pool restores service. Reasoning: 502 means the proxy could not obtain a valid origin response, not that the WAF blocked the request, so the investigation starts at the origin connection.

Traps that cost marks

Changing several settings simultaneously and losing the causal link. Forgetting that a redeploy from AS3 or DO reverts manual fixes. Ignoring NTP, since clock skew breaks JWT and OAuth validation. Misreading a WAF block (which returns a support ID) as an application 5xx. Not collecting qkview before a restart, then having nothing to send to support.