F5 F5CAB1 - BIG-IP Administration Install, Initial Configuration, and Upgrade

To identify which boot volume is currently active on a BIG-IP system, the correct command is:

tmsh show sys software status

This command displays:

All installed boot volumes (HD1.1, HD1.2, HD1.3, etc.)

The BIG-IP software version installed on each volume

The Active field, indicating which volume the system is currently booted from

The installation status (“complete”, “in-progress”, “allowed”)

This is the standard and authoritative way to determine the active boot location.

Why the other options are incorrect:

A. tmsh show sys version

Displays OS version, build, and date.

Does not show boot locations or which volume is active.

C. tmsh list sys software update

Shows software update configurations, not boot volume status.

Does not display which volume is active.

By default, management-plane traffic uses the management routing table , while data-plane traffic uses the TMM routing table .

Remote Syslog traffic is management-plane traffic unless a management route exists.

If no Management Route matches the Syslog server’s destination IP, the BIG-IP will instead:

Use TMM routes , and

Source the packets from a Self IP

This is exactly what the administrator is observing.

To force Syslog traffic out the management port:

You must create a Management Route , which is configured using:

tmsh create /sys management-route < name > gateway < ip > network < syslog subnet >

This sends syslog traffic:

Out of the management interface

Using the Management IP as the source

Thus, Option B is correct.

Why the other options are incorrect:

A. Set the Management IP as the source address

Source address selection is overridden by routing.

Without a management route, traffic still goes out the data plane.

C. Create a new Self IP using a route domain

Unnecessary and not related to management-plane routing.

Syslog traffic should not rely on data-plane Self IPs.

D. Modify port lockdown on Self IP to allow UDP/514

This would allow Syslog traffic into the BIG-IP over a Self IP, not force outbound traffic via management.

For BIG-IP high-availability (HA) pairs, F5’s recommended upgrade workflow prioritizes service continuity , predictable failover , and minimal downtime . The established best-practice sequence is:

Upgrade the standby unit first

Because the standby device is not passing traffic, upgrading and rebooting it does not impact production.

Boot the standby unit into the newly installed version

Once online, the administrator verifies basic health, device sync status, cluster communication, and module functionality.

Perform a controlled failover to the upgraded unit

Traffic shifts to the newly upgraded device, allowing validation of the configuration and operational behavior under real traffic loads.

Upgrade the second device (now standby)

The previously active device becomes standby after failover, allowing it to be safely upgraded and rebooted without interruption.

This phased approach ensures only one device is unavailable at a time, allowing continuous traffic flow throughout the upgrade process.

Why the Correct Answer is C

Option C exactly matches F5’s documented production-safe upgrade method:

Upgrade the standby node first

Reboot into new image

Failover to upgraded device

Validate

Upgrade the remaining (now-standby) device

This procedure minimizes risk and traffic disruption.

Why the other options are incorrect:

A. Upgrade the active node first

Upgrading the active device requires removing it from service and failing over abruptly. This is not recommended and increases service disruption risk.

B. Resetting device trust

Resetting trust is unnecessary and can disrupt configuration sync, peer communication, and cluster operation. It is not part of any standard upgrade workflow.

D. Upgrading and rebooting both nodes simultaneously

This would cause total outage , because both HA members would be unavailable at the same time.

Securing the BIG-IP management interface is a fundamental administrative responsibility. F5 best practices emphasize restricting who can reach the management port and ensuring that only authorized systems are allowed access.

A. Limiting management access to trusted network segments

F5 recommends placing the management interface on a dedicated, isolated, and secured management network or VLAN , rather than exposing it to production or untrusted networks.

This reduces the attack surface by ensuring only trusted segments have visibility to administrative interfaces.

D. Restricting management access by IP or subnet

F5 BIG-IP uses the /sys httpd allow list (for HTTPS) and configuration options in sshd (for SSH) to control which IP addresses or subnets can access the device.

By specifying only known administrative IPs or ranges, unauthorized users cannot reach the login services.

Why the other options are incorrect

B. Blocking all management HTTPS/SSH ports

This would prevent any administrative access and is not a viable security practice.

C. Using Self-IP addresses for administrative access

F5 explicitly warns against using Self-IPs for management access unless strictly necessary.

Self-IPs are exposed to the data plane and should not be used as the primary administrative interface.

To change the boot volume on a BIG-IP system from one installed TMOS version to another, the correct CLI tool is:

switchboot

The correct syntax uses the -b flag:

switchboot -b < volume >

This command marks the specified boot location as the one to be used on the next reboot.

Thus, to boot into HD1.2 which contains 13.1.0.6 , the sequence is:

Mark HD1.2 as the next boot location:

switchboot -b HD1.2

Reboot the system:

reboot

This is the standard and officially supported method for selecting a different installed volume.

Why the other options are incorrect:

A. " tmsh reboot HD1.2 "

There is no such tmsh syntax.

Boot volume cannot be selected by adding a parameter to reboot.

C. switchboot -I HD1.2

The -I flag is invalid. Only -b is used.

D. " tmsh switchboot HD1.2 "

switchboot is not a tmsh command; it is a system-level shell utility.

Therefore, Option B is the correct and valid command sequence.

The BIG-IP system has built-in licensing enforcement.

If an administrator provisions a module that the device is not licensed to run, the system will still allow the provisioning action to occur initially , but the system detects the mismatch and displays an alert.

What actually happens:

The GUI places a warning banner in the upper-left corner labeled something similar to: “Provisioning Warning”

This appears immediately after provisioning a module that is not included in the active license.

The system remains in an “inconsistent state” until the module is disabled again or the license is updated.

This is the visual cue BIG-IP uses to indicate that a module was provisioned without valid licensing.

Why the other options are incorrect:

A. “A BIG-IP does not allow unlicensed modules to be provisioned.”

Not true. BIG-IP does allow provisioning, but warns afterward.

B. “A warning will appear when provisioning an unlicensed module.”

The warning does not appear during the provisioning step itself.

It appears after provisioning , in the main GUI, as a system banner.

BIG-IP hardware platforms use chassis LEDs to indicate system health states.

A solid yellow status LED typically indicates a warning condition , such as:

A non-critical hardware alert

A temperature threshold nearing limit

A minor fan or sensor irregularity

Other non-fatal environmental or system conditions

This state reflects a warning-level alarm , meaning the unit is operational but requires investigation.

Why the other options are incorrect

A. Halted or EUD mode

This is associated with different LED patterns (usually flashing conditions or specific color codes), not a solid yellow status LED.

B. Standby in device group

HA state is not indicated by the chassis status LED.

Standby status is a logical device state, not a hardware LED state.

D. Power supply failure

Power supply indicators use separate LEDs located on each power module (usually flashing amber/red), not the system status LED.

Thus, a solid yellow status indicator signifies a warning-level alarm .

Comprehensive and Detailed Explanation From BIG-IP Administration — Install, Initial Configuration, and Upgrade:

The Service Check Date embedded in the BIG-IP license acts as a gating mechanism that determines eligibility for software updates. F5 enforces that the Service Check Date must be equal to or newer than the software release date of any BIG-IP version being installed. If the installed license carries a Service Check Date from two years ago, attempting to upgrade to a newly released BIG-IP software version — whose release date post-dates that Service Check Date — will fail, as the system validates this date during the upgrade process.

Option A is incorrect — generating and uploading a QkView to F5 iHealth is a diagnostic activity that requires no license validation or Service Check Date verification whatsoever.

Option C is incorrect — ASM signature and threat campaign updates are content updates, not platform software upgrades. These updates are independent of the Service Check Date requirement and do not trigger license validation checks during installation.

Only a platform software upgrade to a newly released BIG-IP version directly invokes the Service Check Date validation, mandating license renewal prior to the upgrade proceeding successfully.

Reference Topics: License Service Check Date, Software Upgrade Prerequisites, License Reactivation — BIG-IP Administration Study Guide.

From the exhibit, the administrator performs the following actions:

Displays the current SSH allow configuration:

tmsh list sys sshd allow

allow { ALL }

Replaces the existing SSH allow list with a specific subnet:

tmsh modify sys sshd allow replace-all-with { 10.0.0.0/24 }

Confirms the updated configuration:

tmsh list sys sshd allow

allow { 10.0.0.0/24 }

This configuration restricts SSH access to only hosts that fall within the 10.0.0.0/24 network.

Evaluation of the options

A. 10.0.0.100

This address is within the 10.0.0.0/24 subnet and is a valid host address, so SSH access is permitted.

B. 10.0.0.254

This address is also within the 10.0.0.0/24 subnet and is a valid host address, so SSH access is permitted.

C. 10.0.0.256

This is not a valid IP address because an IPv4 octet cannot exceed 255.

D. 100.0.1.10

This address is outside the configured 10.0.0.0/24 subnet and will not be allowed.

E. 100.0.0.10

This address is also outside the configured subnet and will not be allowed.