Firewall Rules for Self-IPs F5CAB1 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A BIG-IP Administrator notices that the Self-IP on VLAN internal (192.168.10.1/24) is responding to ICMP echo requests from any source on the internal network. The security policy requires that only the monitoring server at 192.168.10.100 should be able to ping the Self-IP. The administrator adds a firewall rule to the Self-IP rule list: source 192.168.10.100, destination 192.168.10.1, port 8 (ICMP echo), action Accept. After applying the rule, the monitoring server can ping the Self-IP, but other hosts can still ping it. What is the most likely reason for this?

   • AThe destination should be set to 192.168.10.0/24 to cover all Self-IPs on the VLAN.
   • BThe rule was applied to the wrong VLAN; it should be applied to the external VLAN.
   • CThe default Self-IP firewall behavior includes an implicit allow rule for ICMP that must be overridden with an explicit Deny rule.
   • DThe rule order is incorrect; the implicit allow rule is evaluated before the explicit Accept rule.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A BIG-IP Administrator is troubleshooting why a Self-IP firewall rule is not working as expected. The rule is intended to allow HTTPS (port 443) from the admin subnet 10.10.10.0/24 to the Self-IP 10.10.10.1. The rule is placed at the top of the Self-IP rule list. The administrator verifies that the rule is correctly configured and applied. However, HTTPS access from the admin subnet is failing, while HTTPS access from other subnets is working. What is the most likely cause?

   • AThere is a conflicting rule earlier in the list that is denying HTTPS from the admin subnet.
   • BThe default Self-IP firewall behavior includes an implicit allow rule for HTTPS that is overriding the explicit Deny rule.
   • CThe rule is not applied to the correct VLAN; it should be applied to the VLAN where the admin subnet resides.
   • DThe destination in the rule should be set to 0.0.0.0/0 to cover all Self-IPs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An administrator is configuring Self-IP firewall rules on a BIG-IP device. The requirement is to allow HTTPS management access (port 443) from the corporate admin subnet 10.20.0.0/24, and to block all other management access. The administrator creates two rules: Rule 1 (Accept, source 10.20.0.0/24, destination Self-IP, port 443) and Rule 2 (Deny, source any, destination Self-IP, port any). What is the correct order for these rules in the Self-IP firewall rule list?

   • ARule 1 first, then Rule 2.
   • BBoth rules should be placed in a single rule with multiple actions.
   • CRule 2 first, then Rule 1.
   • DThe order does not matter because the most specific rule is always applied.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An administrator is creating Self-IP firewall rules on a BIG-IP device. The requirement is to allow NTP (port 123) from the time server 192.168.2.10 to the Self-IP 192.168.2.1, and to block all other NTP traffic. The administrator creates an Accept rule for the time server and a Deny rule for all other sources. What is the correct order for these rules?

   • AAccept rule first, then Deny rule.
   • BBoth rules should be combined into a single rule with a 'match any' action.
   • CDeny rule first, then Accept rule.
   • DThe order does not matter because the most specific rule is always applied.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A BIG-IP Administrator is troubleshooting why a new firewall rule for a Self-IP is not working as expected. The rule is intended to allow SNMP (port 161) from the monitoring server 192.168.1.50 to the Self-IP 192.168.1.1. The rule is placed at the bottom of the Self-IP firewall rule list. The administrator verifies that the rule is correctly configured and applied. However, SNMP queries from the monitoring server are still failing. What is the most likely cause?

   • AThe destination in the rule should be the SNMP server's IP address, not the Self-IP.
   • BAn earlier rule in the list is denying SNMP traffic before the new rule is evaluated.
   • CThe Self-IP is not assigned to the correct VLAN.
   • DThe SNMP service is not enabled on the BIG-IP device.
   Reveal Solution Discussion Select an answer first