F5-402 cheat sheet
F5-402 · Keep the key ideas within reach.
F5 cloud architecture, declarations and operational control
Cloud placement does not remove customer configuration and state responsibilities.
DO and AS3 address different configuration layers under supported versions.
Accepted asynchronous operations need completion and service verification.
Telemetry, scaling and recovery must include actual dependencies and state.
BIG-IP LTM listeners, persistence and TLS boundaries
Virtual servers, pools, members and nodes have distinct roles.
Persistence needs a key and lifetime appropriate to actual application state.
Client-side and backend TLS have independent trust requirements.
Profile and iRule behavior is event-, version- and configuration-dependent.
BIG-IP application security, access and DNS decisions
Application security, access decisions and network protection differ.
APM session and request policies have different timing and roles.
Wide IP selection produces DNS answers whose later use depends on caching and clients.
An enabled module is not proof of capacity or complete protection.
BIG-IP TMOS operation, configuration and recovery evidence
Traffic processing, management and configuration responsibilities differ.
Green status needs the actual monitor and listener context.
Configuration synchronization is not universal runtime-state replication.
Archives and diagnostic collections need sensitive-data handling and tested recovery.
Application-delivery paths, health and state
Separate front-end and backend connection contexts.
A monitor proves only its configured observation.
Persistence is different from application session storage.
Routing, source translation and TLS need a complete path model.
Identity, access and cryptographic protection
Identification, authentication, authorisation and accounting are four distinct steps.
MFA needs two different factor categories, not two instances of one.
RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.
Kerberos uses a KDC with TGT and service tickets for SSO.
Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.
Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.
ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.
Network boundaries and protected communication
Internet-facing services belong in a DMZ; data stores sit in a filtered internal zone.
VLANs alone are not a trust boundary - add DAI, private VLANs and 802.1 X.
IPsec AH gives integrity only; ESP adds confidentiality.
IDS is passive and alerts; IPS is inline and blocks.
NAT is not a security control and temporary rules must be removed.
Security operations, monitoring and response
Asset inventory and configuration baselines underpin every operational control.
Changes need an appropriate authorization path, recovery planning and relevant evidence.
Emergency changes still require retrospective documentation within a defined window.
Monitor log sources for silence, not just for events.
Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.
Containment precedes eradication in almost every scenario.
Capture volatile evidence (memory, connections) before disk and before power-off.
Continuity, backup and technical recovery
Distinguish tolerated data loss from tolerated interruption.
A recovery point and restore time must both meet the stated targets.
A same-failure-domain snapshot alone does not cover loss of that domain.
Verify complete restore procedures and actual dependency behavior.