When a TMOS image (.iso file) is uploaded into the /shared/images/ directory, the BIG-IP performs an internal validation step before the ISO appears in the GUI.
1. The system verifies the internal checksum
BIG-IP automatically reads the embedded checksum inside the ISO file
Verifies integrity of the uploaded image
Confirms the file is not corrupted or incomplete
Ensures the image is a valid F5 TMOS software image
Only after this checksum verification succeeds does the image appear under:
System -> Software Management -> Image List

Self-IPs implement a security feature known asPort Lockdown, which limits which services are reachable on a Self-IP.
However, certain services required for BIG-IP device-to-device communication bypass Port Lockdown to ensure cluster and HA functionality.
TCP 4353
* TCP port4353is used byDevice Service Clustering (DSC)for:
* Device trust establishment
* Configuration synchronization
* Failover communication
* Because BIG-IP devices must always be able to communicate for HA functions to remain operational, port 4353 isexempt from Port Lockdown rules.
Why the other options are incorrect
A). TCP 443
* Not required for device trust or synchronization.
* HTTPS access is fully controlled by Port Lockdown.
C). UDP 53
* DNS traffic is not required for synchronization and has no exemption under Port Lockdown.

BIG-IP controls access to the web-based Configuration Utility (TMUI) through the/sys httpd allowlist. This parameter specifies which client IPs or subnets may initiate HTTP/HTTPS connections to the management interface.
To restrict TMUI access toonlythe 10.0.0.0/24 subnet:
* The correct method is tomodify the HTTPD allow listso that it contains only this subnet.
* This requires replacing the entire current list with the new subnet using:
modify /sys httpd allow replace-all-with {10.0.0.0/24}
This ensures thatonlyclients within 10.0.0.0/24 can reach the Configuration Utility.
Why the other options are incorrect:
* Options A and Ccreate network ACL objects under /net acl, which apply to data-plane traffic, not management-plane TMUI access. TMUI access is not controlled by LTM ACLs but by the HTTPD allow directive.
* Option Bis incorrect syntax and references /ltm httpd, which is not the proper object; the correct hierarchy is /sys httpd.
Thus, only modifying the/sys httpd allowlist achieves the required restriction.

In BIG-IP, software images are installed onboot volumes(for example, HD1.1, HD1.2, HD1.3, etc.).
To install software on anew volume, the administrator must instruct the system to create a new boot location before installation.
There are two correct ways to create a new volume:
A). tmsh command (with correct syntax)
tmsh install software image /shared/images/BIGIP-<version>.iso volume HD1.5 create-volume This syntax correctly includes:
* install software image
* full path to ISO (/shared/images/...)
* volume name (HD1.5)
* create-volumekeyword
This instructs BIG-IP to create the new boot volume as part of the installation.
C). Using the GUI # System > Disk Management
From the Disk Management menu, the administrator can:
* Select "New Volume"
* Enter the volume identifier (e.g., HD1.5)
* Apply changes
This GUI method is officially supported and explicitly creates a new boot volume before installing the software.
Why the other options are incorrect:
B). Incorrect tmsh syntax
* Missing /shared/images/ path
* Incorrect command structure
D). Incorrect command structure
* Missing required keywords and correct command hierarchy
E). Software Management # Install does NOT create volumes
* This installs to anexistingvolume only
* The GUI install dialog does not create new boot volumes
Thus, onlyOption AandOption Cproperly create a new software volume.

When logged into the bash shell of a BIG-IP system, there are two valid ways to view the management-ip address:
A). tmsh list /sys management-ip
Even from the bash shell, the administrator can enter a tmsh command by typing:
tmsh list /sys management-ip
This displays:
Management IP address
Netmask
Any configured management routes
This is the official tmsh method for viewing the management-ip configuration.
C). ifconfig mgmt
In the underlying Linux OS, the management interface maps to the mgmt interface.
Running:
ifconfig mgmt
displays:
Assigned management IP
Netmask
Link-level status
This is a valid Linux-level method used frequently for troubleshooting.