I85PREP
⌘ K
F5-CA study materials
F5-CA study resources

F5-CA practice questions

One question at a time. Build your F5-CA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Administration

An administrator needs to change the management IP address of a BIG-IP device that is currently configured with a single self IP on VLAN-EXT. Which object must be modified to change the address used to reach the management GUI?

  1. The management interface address in the device's management route and address configuration Correct answer.
  2. The virtual server address on the external VLAN
  3. The floating self IP on the internal VLAN
  4. The self IP on VLAN-EXT

Explanation

The management port has its own address configuration separate from the traffic-handling self IPs. Changing the address reachable for GUI, SSH, and iControl REST access requires editing the management address, not a self IP. Self IPs and virtual servers serve data-plane traffic and do not control management access.

Question 2Administration

A BIG-IP administrator wants to confirm which software version and hotfix level the device is running before opening a support case. Where is this information displayed in the configuration utility?

  1. System > Configuration > Device > General Properties
  2. System > Platform
  3. System > Support > Tech Support Info Correct answer.
  4. System > Software Management > Hotfix List

Explanation

The Tech Support Info page under System > Support displays the software version, build, and hotfix level along with other diagnostic details. Administrators commonly capture this page when opening support cases. The other pages show platform or device settings but not the full version and hotfix summary.

Question 3Administration

An administrator is preparing a BIG-IP for a maintenance window and needs to verify that the device is the active unit in an active/standby pair before forcing a failover. Which command displays the current failover state from the command line?

  1. tmsh show cm sync-status
  2. tmsh show ltm virtual
  3. tmsh show sys hardware
  4. tmsh show sys ha-status Correct answer.

Explanation

The `tmsh show sys ha-status` command reports the high availability state, indicating whether the device is active or standby. This is the correct command for confirming failover state before a maintenance action. The other commands report sync status, hardware inventory, or virtual server status.

Question 4Administration

A BIG-IP administrator needs to add a new local user account that can manage virtual servers but should not be able to change system-level settings. Which role should be assigned to satisfy this requirement?

  1. Resource Administrator
  2. Manager Correct answer.
  3. Operator
  4. Administrator

Explanation

The Manager role grants the ability to configure most traffic management objects, including virtual servers and pools, without granting full system-level control. The Administrator role grants full access, which exceeds the requirement. Operator is read-only and Resource Administrator has broader object-management rights than needed.

Question 5Administration

An administrator wants to back up the BIG-IP configuration before applying a hotfix. Which action creates a restorable configuration archive using the configuration utility?

  1. System > Configuration > Device > Save configuration
  2. System > Logs > Configuration > Export log
  3. System > Software Management > Export image
  4. System > Archives > Create and save a UCS archive Correct answer.

Explanation

A UCS archive captures the full configuration and is the standard backup that can be restored after upgrades or changes. Creating the archive is done under System > Archives. Saving the running configuration or exporting images and logs does not produce a full restorable backup.

Question 6Administration

An administrator needs to verify that NTP is correctly synchronizing the BIG-IP clock, because inaccurate time can break certificate validation and log correlation. Which command shows the current time synchronization status?

  1. ntpq -p Correct answer.
  2. date
  3. timedatectl status
  4. tmsh show sys clock

Explanation

The `ntpq -p` command lists configured NTP peers and shows whether the device is synchronized and which server is the reference. This confirms synchronization health rather than just displaying the current time. The `date` command shows the local clock but not the synchronization state.

Question 7Administration

An administrator plans to install a new software image on a BIG-IP using the inactive boot location. Which statement describes the correct procedure?

  1. Install the image to the inactive volume, reboot into it, and verify functionality before setting it as the default Correct answer.
  2. Install the image and immediately delete the previous volume
  3. Install the image to the active volume and reboot without verification
  4. Overwrite the active volume directly to save disk space

Explanation

Installing to the inactive boot location preserves the running configuration and allows a controlled reboot into the new image for validation. Only after verifying functionality should the administrator set the new volume as the default. Overwriting the active volume risks an unrecoverable failure if the new image does not boot.

Question 8Administration

A BIG-IP administrator notices that the configuration on the standby unit differs from the active unit after a manual change. Which action should be taken to bring the devices back into sync?

  1. Reboot the standby device to force a reload
  2. Delete the device group and recreate it
  3. Run a full sync from the device with the correct configuration Correct answer.
  4. Disable and re-enable the network failover setting

Explanation

A full sync pushes the configuration from the device with the desired state to its peer, restoring consistency. Rebooting or toggling failover settings does not reconcile configuration differences. Recreating the device group is disruptive and unnecessary for a sync issue.

Question 9Administration

An administrator wants to restrict management GUI access to a specific subnet using the BIG-IP configuration. Which setting should be configured?

  1. Management interface allowed addresses Correct answer.
  2. Packet filter rules on the external VLAN
  3. SNAT pool for management traffic
  4. Self IP port lockdown

Explanation

The management allowed-addresses setting restricts which source networks can reach the management interface for GUI and SSH access. Port lockdown controls which services a self IP accepts on the data plane, not the management port. Packet filters and SNAT pools do not restrict management GUI access in this way.

Question 10Administration

An administrator needs to create a custom administrative partition so that a team can manage only its own virtual servers and pools. Which statement about partitions is correct?

  1. Partitions isolate traffic so that virtual servers cannot reference objects in other partitions
  2. Objects in a partition are visible only to users with access to that partition, and common objects are shared Correct answer.
  3. Partitions replace the need for user roles
  4. Creating a partition automatically creates a new device group

Explanation

Administrative partitions divide the configuration so that users with partition-scoped access see only their objects, while objects in the Common partition remain shared. Partitions are an administrative boundary, not a traffic isolation mechanism. They do not create device groups or eliminate the need for role-based access.

Question 11Administration

A security policy requires that the BIG-IP administrator account use multi-factor authentication for GUI logins. Which configuration area should be used to enforce this?

  1. Access policy on the management virtual server
  2. Self IP port lockdown on the management VLAN
  3. Client SSL profile on the management interface
  4. Authentication settings for the administrative user with a remote MFA provider Correct answer.

Explanation

MFA for administrative logins is enforced through the authentication configuration, typically by integrating a remote authentication provider that supports MFA. Access policies and SSL profiles apply to data-plane virtual servers. Port lockdown controls which services are exposed on a self IP and does not add MFA.

Question 12Administration

An administrator is asked to verify which license features are active on a BIG-IP before enabling a module. Where can this be checked in the configuration utility?

  1. System > License Correct answer.
  2. System > Software Management > Image List
  3. System > Configuration > Device > General Properties
  4. System > Support > Tech Support Info

Explanation

The System > License page lists the provisioned and licensed modules and their status. This is the correct place to confirm whether a feature such as ASM or APM is available before enabling it. The other pages show device settings, images, or diagnostic information rather than license entitlements.

Question 13Administration

An administrator needs to ensure that a BIG-IP automatically fails over to the peer when the active unit loses its network connection to the default gateway. Which configuration supports this requirement?

  1. Configure a network failover setting with a peer address and enable it in the device group Correct answer.
  2. Disable the failover state on the standby unit
  3. Enable hardwired failover only
  4. Set the device group to sync-failover with no network failover addresses

Explanation

Network failover uses a configured peer address to detect loss of connectivity and trigger a failover to the peer. Enabling it in the device group allows the standby to take over when the active unit cannot reach the peer. Hardwired failover only detects cable-level failures, and disabling failover prevents the desired behavior.

Question 14Administration

A BIG-IP administrator needs to restore a device to a known-good configuration after a failed change. Which statement describes the correct restore procedure?

  1. Extract the UCS archive and copy individual files into /config
  2. Load the UCS archive and reboot the device to apply the restored configuration Correct answer.
  3. Import the UCS archive into the Common partition without rebooting
  4. Copy the UCS archive to the active volume and restart services only

Explanation

Restoring a UCS archive loads the saved configuration and requires a reboot to apply it fully. Manually copying files or restarting services alone does not reliably restore the configuration. Importing without rebooting can leave the running state inconsistent with the restored files.

Question 15Administration

An administrator wants to collect diagnostic information to send to support after an unexpected failover. Which action produces the appropriate bundle?

  1. Run `tmsh show sys ha-status` and send the output
  2. Export the audit log only
  3. Create a UCS archive and send it
  4. Generate a qkview from the affected device Correct answer.

Explanation

A qkview collects logs, configuration, and diagnostic data into a single bundle intended for support analysis. A UCS archive contains configuration but not the full diagnostic set. Audit logs or a single command output provide only a narrow view of the event.

Question 16Administration

An administrator is configuring a device group for an active/standby pair and needs to choose the correct failover method. Which statement about failover methods is accurate?

  1. Network failover and hardwired failover can be enabled together to detect different failure types Correct answer.
  2. Network failover requires a direct serial cable between devices
  3. Only one failover method can be configured per device group
  4. Hardwired failover requires a peer address to be configured

Explanation

Network and hardwired failover can be enabled together so the pair detects both connectivity loss and physical link failure. Hardwired failover relies on a direct cable, while network failover uses a peer address. Requiring only one method would reduce detection coverage.

Question 17Administration

An administrator wants to change the default idle timeout for administrative GUI sessions to reduce the risk of unattended sessions. Which setting should be adjusted?

  1. The HTTP profile idle timeout on the management virtual server
  2. The TCP idle timeout on the management self IP
  3. The administrative GUI session timeout in the system preferences Correct answer.
  4. The client SSL profile renegotiation timeout

Explanation

Administrative GUI session timeout is controlled by a system preference that defines how long an idle session remains valid. HTTP and TCP idle timeouts apply to data-plane traffic profiles. SSL renegotiation settings affect secure connections but not GUI session lifetime.

Question 18Administration

An administrator needs to confirm that a BIG-IP is provisioned for Local Traffic Manager before creating virtual servers. Which command displays the current provisioning level?

  1. tmsh list sys provision Correct answer.
  2. tmsh show ltm virtual
  3. tmsh show sys ha-status
  4. tmsh list sys license

Explanation

The `tmsh list sys provision` command shows which modules are provisioned and at what level. This confirms whether LTM is enabled before virtual server configuration. The other commands list virtual servers, license details, or HA state rather than provisioning level.

Question 19Administration

An administrator is asked to enable remote syslog forwarding so that BIG-IP logs are sent to a central collector. Which configuration area is used for this?

  1. System > Archives
  2. System > Logs > Configuration > Remote Logging Correct answer.
  3. System > Software Management
  4. System > Configuration > Device > General Properties

Explanation

Remote syslog forwarding is configured under System > Logs > Configuration, where the administrator defines the remote server and which log facilities to forward. The other pages manage device settings, archives, or software images rather than log forwarding.

Question 20Administration

An administrator needs to verify that the BIG-IP can reach a remote authentication server used for administrative logins. Which tool is most appropriate for testing connectivity to the server's port?

  1. traceroute
  2. ping
  3. tmsh show sys ha-status
  4. telnet or a TCP connectivity test to the server port Correct answer.

Explanation

Ping only verifies ICMP reachability and does not confirm that the authentication service port is open. A TCP connectivity test to the specific port confirms whether the service is reachable. Traceroute shows the path but not whether the port accepts connections.

Question 21Administration

An administrator is reviewing an audit log after an unexpected configuration change and needs to identify which user made the change. Which log source should be examined?

  1. The LTM virtual server statistics
  2. The NTP synchronization log
  3. The audit log, which records administrative actions and the associated user Correct answer.
  4. The system hardware log

Explanation

The audit log records administrative actions together with the user and timestamp, which is exactly what is needed to attribute a configuration change. Virtual server statistics, hardware logs, and NTP logs do not track administrative actions. Reviewing the audit log is the standard way to identify who made a change.

Question 22Administration

An administrator wants to automate routine configuration checks using the iControl REST API. Which statement about authentication for REST calls is correct?

  1. REST calls must be made from the console only
  2. REST calls bypass user roles and always run with full administrative rights
  3. REST calls require a self IP on the external VLAN
  4. REST calls require valid credentials or a token and are subject to the same role-based permissions as GUI users Correct answer.

Explanation

iControl REST requests authenticate with credentials or a token and are authorized according to the user's role and partition access, just like GUI sessions. They do not bypass role-based permissions. REST access is available over the management or configured interfaces, not only from the console.

Question 23Administration

An administrator is troubleshooting why the standby unit does not take over when the active unit fails. The device group is configured for sync-failover, network failover is enabled, and the peer address is reachable. Which additional condition could prevent failover?

  1. The standby unit has a different hostname
  2. The failover state is disabled on the standby unit Correct answer.
  3. The audit log has been rotated
  4. The Common partition contains shared objects

Explanation

If the failover state is disabled on the standby unit, it cannot assume the active role even when the peer becomes unreachable. Shared Common objects, differing hostnames, and log rotation do not prevent failover. Checking the failover state is therefore a key troubleshooting step.

Question 24Administration

An administrator needs to apply a change to the active unit in an active/standby pair without immediately propagating it to the standby. Which approach supports this requirement?

  1. Make the change while config sync is set to manual, then sync when ready Correct answer.
  2. Disable the device group and reboot both units
  3. Change the active unit's hostname before making the change
  4. Delete the standby unit's configuration before making the change

Explanation

With configuration synchronization set to manual, changes on the active unit are not automatically pushed to the peer, allowing controlled rollout. Disabling the device group or deleting the standby configuration is disruptive and unnecessary. Changing the hostname does not control sync behavior.

Question 25Administration

An administrator is planning a software upgrade and must decide whether the existing configuration will be preserved. Which statement about upgrading to a new boot location is correct?

  1. The new boot location cannot be created if the active volume is not full
  2. The new boot location starts with a default configuration that must be rebuilt manually
  3. The new boot location requires the license to be re-entered from scratch
  4. The new boot location inherits the configuration from the currently active volume during installation Correct answer.

Explanation

When installing to an inactive boot location, the existing configuration is copied to the new volume so the device can boot into the new image with the current settings. The license is also carried over, so it does not need to be re-entered. The administrator should still validate functionality before making the new volume the default.

Question 26Administration

An administrator must give a new network engineer read-only visibility into BIG-IP configuration and statistics without allowing any configuration changes. Which built-in role should the administrator assign?

  1. Guest Correct answer.
  2. Operator
  3. Certificate Manager
  4. Manager

Explanation

The Guest role is the built-in read-only role in BIG-IP user management: it allows viewing of configuration objects and statistics but denies any modification. Roles are assigned per user account and can be scoped to a partition. Choosing Guest is the correct least-privilege assignment for pure visibility.

Question 27Administration

An administrator wants to confirm which administrative users are currently authenticated through remote authentication and which are local accounts. Where in the BIG-IP configuration utility can the administrator review and manage user accounts?

  1. System › Logs › Audit
  2. System › Platform › Configuration
  3. System › Users › User List Correct answer.
  4. Network › Interfaces

Explanation

Administrative accounts, their assigned roles, partitions, and authentication source are managed under System › Users › User List in the configuration utility. This view shows both local and remotely authenticated administrative users. Platform and log screens do not provide account management.

Question 28Administration

An administrator needs to confirm the BIG-IP hostname and management IP address currently configured on the device. Which configuration utility section should the administrator open?

  1. System › Software Management
  2. System › Certificate Management
  3. System › Configuration
  4. System › Platform Correct answer.

Explanation

Hostname, management address, and related platform identity settings are configured under System › Platform. This section is the authoritative place to verify the device identity used for management and licensing. The other sections cover different administrative functions.

Question 29Administration

An administrator is preparing to back up the BIG-IP configuration before a maintenance window. Which statement describes what a UCS archive contains?

  1. It contains only the active software image for reinstalling the operating system.
  2. It includes the configuration files and, depending on the selected options, may include license and certificate material. Correct answer.
  3. It captures only statistics and log files for troubleshooting purposes.
  4. It stores only the network interface configuration and VLAN assignments.

Explanation

A UCS archive is a configuration backup that packages configuration files and can optionally include license files and SSL certificate/key material when those options are selected. It is restored with the load command or through the configuration utility. It is not a software image and not a statistics bundle.

Question 30Administration

An administrator needs to allow a specific external subnet to reach the BIG-IP management interface on port 443 while blocking all other source addresses. Which configuration object should be used?

  1. A SNAT pool referencing the management subnet
  2. A management interface firewall rule or allowed-addresses list Correct answer.
  3. A self IP with port lockdown set to Allow None
  4. A virtual server with an HTTP profile

Explanation

Access to the management interface is controlled through the management interface's allowed-addresses configuration or management firewall rules, which permit specific source subnets. Virtual servers and self IP port lockdown apply to data-plane traffic, not management access. SNAT pools affect outbound translation and do not restrict management access.

Question 31Administration

An administrator needs to define a custom administrative partition so that a team can manage only its own virtual servers and pools. Which statement about partitions is correct?

  1. Objects created in a partition are visible to users assigned to that partition, and the partition name becomes part of the object path. Correct answer.
  2. A user assigned to one partition automatically gains full access to all other partitions.
  3. Partitions require a separate license before they can be created.
  4. Partitions can contain only virtual servers and cannot hold pools or profiles.

Explanation

Administrative partitions isolate objects so that users assigned to a partition can manage only those objects, and object paths are prefixed with the partition name. Partitions are a built-in feature and require no additional license. Access to other partitions is not granted automatically.

Question 32Administration

A security policy requires that the BIG-IP administrator account use multi-factor authentication for GUI logins. Which approach satisfies this requirement?

  1. Configure remote authentication to an external server that enforces MFA, and assign the administrator account to that authentication source. Correct answer.
  2. Set the administrative idle timeout to a very short value.
  3. Enable the default password policy and shorten the password expiration interval.
  4. Restrict management access to a single source subnet.

Explanation

BIG-IP can delegate administrative authentication to an external authentication server, which can enforce multi-factor authentication. The administrator account is then associated with that authentication source. Password policies, source restrictions, and idle timeouts are useful controls but do not provide a second authentication factor.

Question 33Administration

An administrator is asked to verify which license features are active on a BIG-IP before enabling a module. Where can the administrator review the licensed and provisioned modules?

  1. System › File Management
  2. System › Logs
  3. System › License Correct answer.
  4. System › Software Management

Explanation

The licensed features and their status are shown under System › License in the configuration utility. Provisioning of modules is managed under System › Resource Provisioning. Reviewing License first confirms which features the device is entitled to use.

Question 34Administration

An administrator wants to ensure that a BIG-IP automatically fails over to the peer when the active unit loses its network connectivity to the default gateway. Which configuration should the administrator verify?

  1. The administrative idle timeout
  2. The gateway ICMP monitor assigned to the floating self IP in the device group Correct answer.
  3. The management interface's allowed-addresses list
  4. The virtual server's HTTP profile timeout

Explanation

Failover based on network reachability is driven by the gateway ICMP monitor associated with the floating self IP in the device group. If the monitor marks the self IP down, the device group can trigger failover. HTTP profile timeouts and management settings do not control this behavior.

Question 35Administration

An administrator needs to restore a device to a known-good configuration after a failed change. Which statement describes the correct restore procedure?

  1. Apply the UCS archive using tmsh modify sys software.
  2. Copy the UCS archive to a boot location and reboot into it.
  3. Load the UCS archive with the load command or through the configuration utility, and the device reloads with the saved configuration. Correct answer.
  4. Import the UCS archive into a virtual server as a profile.

Explanation

Restoring a UCS archive is performed with the load command or through the configuration utility, and the device reloads using the archived configuration. A UCS archive is a configuration backup, not a bootable software image. It cannot be applied as a profile or through a software modification command.

Question 36Administration

An administrator wants to collect diagnostic information to send to support after an unexpected failover. Which action provides the appropriate diagnostic bundle?

  1. Generate a qkview from the device and include it with the support case. Correct answer.
  2. Copy the UCS archive to the peer device.
  3. Export the audit log only.
  4. Download the active software image.

Explanation

A qkview is the diagnostic collection that gathers configuration, logs, and system state for support analysis. It is generated on the device and uploaded with the case. Audit logs alone are insufficient, and software images or UCS archives are not diagnostic bundles.

Question 37Administration

An administrator is configuring a device group for an active/standby pair and needs to choose the correct failover method. Which failover method triggers failover based on the health of network objects monitored by the device group?

  1. Network failover Correct answer.
  2. Always-standby configuration
  3. Manual failover only
  4. Hardware failover

Explanation

Network failover uses the device group's network monitors and failover addresses to detect loss of connectivity and trigger a failover. Hardware failover relies on platform-level signals rather than monitored network objects. Manual failover requires an administrator to act.

Question 38Administration

An administrator wants to change the default idle timeout for administrative GUI sessions to reduce the risk of unattended sessions. Which setting should the administrator modify?

  1. The virtual server's TCP idle timeout
  2. The pool member's monitor interval
  3. The SNAT translation idle timeout
  4. The HTTP/HTTPS idle timeout in the management interface configuration Correct answer.

Explanation

Administrative GUI session behavior is controlled by the management interface's HTTP/HTTPS settings, including the idle timeout. Virtual server, pool monitor, and SNAT timeout settings affect data-plane traffic and do not govern GUI sessions. Adjusting the management idle timeout reduces unattended session risk.

Question 39Administration

An administrator needs to confirm that a BIG-IP is provisioned for Local Traffic Manager before creating virtual servers. Which location shows the provisioning status of modules?

  1. System › SNMP
  2. System › Resource Provisioning Correct answer.
  3. System › Users
  4. System › License

Explanation

Module provisioning is managed under System › Resource Provisioning, where each module's provisioned level is displayed. A module must be provisioned before its objects can be used. The License page shows entitlements, not the provisioning state.

Question 40Administration

An administrator is asked to enable remote syslog forwarding so that BIG-IP logs are sent to a central collector. Which configuration is required?

  1. Add the collector as a pool member behind a syslog virtual server.
  2. Create a virtual server that forwards UDP port 514 to the collector.
  3. Enable the audit log and export it as a UCS archive.
  4. Define a remote syslog server and select the log facilities to forward to it. Correct answer.

Explanation

Remote logging is configured by specifying the remote syslog server address and choosing which facilities and severity levels to forward. The BIG-IP sends logs directly to the collector without requiring a virtual server. Audit log export is unrelated to live syslog forwarding.

Question 41Administration

An administrator needs to verify that the BIG-IP can reach a remote authentication server used for administrative logins. Which action best validates reachability before testing a login?

  1. Review the SNAT pool configuration for the authentication subnet.
  2. Check the virtual server statistics for the authentication port.
  3. Use the ping utility from the BIG-IP to the authentication server address. Correct answer.
  4. Inspect the pool member monitor status for the authentication server.

Explanation

The ping utility on the BIG-IP tests basic network reachability from the device to the authentication server. Virtual server statistics and pool member monitors apply to data-plane objects, not the device's own outbound management traffic. Confirming reachability first isolates network problems from authentication configuration issues.

Question 42Administration

An administrator is reviewing an audit log after an unexpected configuration change and needs to identify which user made the change. Which log should the administrator examine?

  1. The APM log, which records access policy sessions
  2. The ASM log, which records security policy violations
  3. The LTM log, which records virtual server traffic events
  4. The audit log, which records administrative actions and the associated user Correct answer.

Explanation

The audit log records administrative configuration changes along with the user who performed them, making it the correct source for attributing a change. LTM, ASM, and APM logs record data-plane and module-specific events rather than administrative actions. Reviewing the audit log is the standard way to trace who changed the configuration.

Question 43Administration

An administrator wants to automate routine configuration checks using the iControl REST API. Which statement about authentication for iControl REST is correct?

  1. The API uses SNMP community strings for authentication.
  2. Requests must be authenticated, for example with token-based authentication or basic authentication over HTTPS. Correct answer.
  3. Authentication is only required for GET requests, not for POST requests.
  4. Requests are accepted without authentication when sent to the management address.

Explanation

iControl REST requires authenticated requests, typically using a token obtained from the authentication endpoint or basic authentication over HTTPS. Unauthenticated requests are rejected. SNMP community strings are unrelated to REST API authentication.

Question 44Administration

An administrator is troubleshooting why the standby unit does not take over when the active unit fails. The device group is configured for network failover. Which condition would prevent failover from occurring?

  1. The client SSL profile is attached to the virtual server.
  2. The failover addresses are unreachable between the peers, so the standby unit cannot detect the active unit's failure. Correct answer.
  3. The pool uses a round-robin load-balancing method.
  4. The virtual server has an HTTP profile attached.

Explanation

Network failover depends on the peers exchanging heartbeat traffic over the configured failover addresses. If those addresses are unreachable, the standby unit may not detect the active unit's failure and failover will not occur. Load-balancing methods and profiles do not affect the failover mechanism.

Question 45Administration

An administrator needs to apply a change to the active unit in an active/standby pair without immediately propagating it to the peer. Which approach accomplishes this?

  1. Delete the device group before making the change.
  2. Make the change and immediately run a full sync to the peer.
  3. Make the change while configuration synchronization is disabled for the device group, then synchronize when ready. Correct answer.
  4. Make the change only on the standby unit and wait for automatic sync.

Explanation

With automatic configuration synchronization disabled, changes made on the active unit are held locally and can be pushed to the peer later with a manual sync. Running a full sync immediately would defeat the goal of delaying propagation. Deleting the device group would disrupt high availability.

Question 46Administration

An administrator is planning a software upgrade and must decide whether the existing configuration will be preserved. Which statement about installing to the inactive boot location is correct?

  1. The installation erases the configuration and requires a full rebuild.
  2. The existing configuration is retained and carried forward when booting the newly installed image. Correct answer.
  3. The installation copies the configuration only if a UCS archive is present.
  4. The installation preserves configuration only for the management interface.

Explanation

Installing a software image to the inactive boot location leaves the current configuration in place, and the configuration is available when the device boots the new image. A full rebuild is not required. UCS archives are used for backup and restore, not as a prerequisite for carrying configuration forward.

Question 47Administration

An administrator wants to restrict SNMP access to the BIG-IP so that only a specific monitoring host can query it. Which configuration should the administrator adjust?

  1. The pool's health monitor interval
  2. The client SSL profile cipher list
  3. The virtual server's source address translation setting
  4. The SNMP allowed addresses and community configuration Correct answer.

Explanation

SNMP access control is configured through the SNMP allowed addresses list and community settings, which determine which hosts may query the device. Virtual server translation, monitor intervals, and cipher lists affect data-plane traffic rather than SNMP access. Restricting allowed addresses limits exposure of SNMP.

Question 48Administration

An administrator is asked to configure a BIG-IP so that administrative logins are logged with the source address for later review. Which setting ensures this information is captured?

  1. Enable the virtual server's request logging in the HTTP profile.
  2. Enable pool member connection logging in the pool settings.
  3. Enable SNMP traps for interface status changes.
  4. Enable logging of administrative access events to the audit log and forward logs to the remote collector. Correct answer.

Explanation

Administrative login events, including source addresses, are captured in the audit log when administrative access logging is enabled, and can be forwarded to a remote collector for retention. HTTP profile request logging and pool connection logging record data-plane traffic, not administrative logins. SNMP traps do not provide login auditing.

Question 49Administration

An administrator needs to confirm the current software version and active boot location on a BIG-IP before a planned upgrade. Which location provides this information?

  1. System › Software Management Correct answer.
  2. System › Users
  3. System › SNMP
  4. System › File Management

Explanation

System › Software Management shows the installed software images, the active boot location, and the version in use. This is the correct place to verify the current version before an upgrade. User, SNMP, and file management screens do not report software version or boot location.

Question 50Administration

An administrator wants to verify that the BIG-IP clock is synchronized with an external time source, because inaccurate time can break certificate validation. Which configuration should the administrator review?

  1. The client SSL profile's cipher selection
  2. The virtual server's persistence timeout
  3. The NTP servers configured under System › Configuration › Device › NTP Correct answer.
  4. The pool's load-balancing method

Explanation

Clock synchronization is configured by specifying NTP servers in the device's NTP settings. Accurate time is essential for certificate validity checks and log correlation. Persistence timeouts, load-balancing methods, and cipher selection do not affect the system clock.