A Self-IP is an IP address assigned to the BIG-IP system for communication within its network or with other devices.
Question 37
A BIG-IP device will be dedicated to functioning as a WAF, requiring only the ASM module to be provisioned. What provisioning level will ensure that the system allocates all CPU, memory, and disk resources to this module exclusively?
Correct Answer: A
Provisioning defines how BIG-IP allocates system resources to modules. The provisioning levels include: Dedicated - allocates all CPU, memory, and disk resources to a single module Nominal - standard resource allocation balanced with other modules Minimal - lowest level, used for basic utility needs None - module disabled Comprehensive / Maximal - not valid TMOS provisioning levels Why "Dedicated" is correct When a BIG-IP device is intended to run only ASM (Web Application Firewall), the recommended way to maximize performance is to provision the module at Dedicated level. With ASM: Dedicated: ASM receives the entire hardware capacity No other modules can or should be provisioned This is explicitly recommended when a device is used solely as a WAF platform
Question 38
The Port Lockdown feature prevents unwanted connection attempts to a Self IP. Which three types of connection attempts are unaffected by Port Lockdown settings?
Correct Answer: C
Port Lockdown controls which ports and protocols a Self IP will respond to. However, certain traffic types bypass Port Lockdown for BIG-IP functionality and routing integrity. The three types that are NOT affected by Port Lockdown are: 1. Defined Virtual Server Traffic Traffic destined to a Self IP that matches a configured virtual server is always accepted by the BIG-IP, regardless of Port Lockdown settings. This ensures that traffic processing does not break when administrators restrict Self-IP ports. 2. ICMP (Internet Control Message Protocol) ICMP (such as ping, traceroute responses, etc.) always passes through a Self IP even when Port Lockdown is set to: Allow Default Allow None Allow Custom F5 allows ICMP for reachability and diagnostic purposes independent of Port Lockdown rules. 3. Centralized Management Infrastructure (CMI) CMI includes the internal HA services used for: Device Trust ConfigSync Failover Mirroring These essential HA communications bypass Port Lockdown to prevent accidental cluster failure. The well-known port for this traffic is TCP 4353, which is always permitted.
Question 39
A BIG-IP Administrator needs to install a HotFix on a standalone BIG-IP device, which has HD1.1 as the Active Boot Location. The administrator has already re-activated the license and created a UCS archive. In which sequence should the administrator perform the remaining steps?
Correct Answer: C
When installing a HotFix on a BIG-IP device, F5 best practices require: Installing the base TMOS image on a new, unused boot volume (HD1.2) This ensures the upgrade happens on a clean volume. The existing active boot location remains untouched for rollback. Installing the HotFix onto the SAME new boot volume (HD1.2) HotFixes must be applied on top of a base version. They cannot be installed on an empty volume. They must match the base image version. Activating the new boot volume (HD1.2) The system reboots into the updated software stack. Activation happens after base + HotFix installation is complete. This sequence is exactly shown in Option C: Install base Image in HD1.2 Install HotFix in HD1.2 Activate HD1.2
Question 40
The Port Lockdown feature prevents unwanted connection attempts to a Self IP. Which three types of connection attempts areunaffectedby Port Lockdown settings?
Correct Answer: C
Port Lockdown controls which ports and protocols aSelf IPwill respond to. However, certain traffic types bypass Port Lockdown for BIG-IP functionality and routing integrity. The three types that areNOT affectedby Port Lockdown are: 1. Defined Virtual Server Traffic Traffic destined to a Self IP that matches aconfigured virtual serveris always accepted by the BIG-IP, regardless of Port Lockdown settings. This ensures that traffic processing does not break when administrators restrict Self-IP ports. 2. ICMP (Internet Control Message Protocol) ICMP (such as ping, traceroute responses, etc.) always passes through a Self IP even when Port Lockdown is set to: * Allow Default * Allow None * Allow Custom F5 allows ICMP for reachability and diagnostic purposes independent of Port Lockdown rules. 3. Centralized Management Infrastructure (CMI) CMI includes the internal HA services used for: * Device Trust * ConfigSync * Failover * Mirroring These essential HA communications bypass Port Lockdown to prevent accidental cluster failure. The well-known port for this traffic isTCP 4353, which is always permitted. Why the other options are incorrect: Option A:SSHisrestricted by Port Lockdown unless explicitly allowed. Option B:Same issue - SSH does not bypass Port Lockdown. OnlyDefined VS Traffic,ICMP, andCMIbypass Port Lockdown.
