Firewall Rules for Self-IPs F5CAB1 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is it necessary to configure firewall rules for Self-IPs on a BIG-IP system?

   • ATo control which management and data-plane traffic is allowed to reach or originate from the Self-IP
   • BTo enable the Self-IP to respond to ARP requests on the network
   • CTo prevent the Self-IP from being used as a source address for outbound traffic
   • DTo ensure the Self-IP is advertised in routing protocols like OSPF
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A BIG-IP Administrator is troubleshooting why a Self-IP firewall rule is not working. The rule is intended to allow SNMP (port 161) from the monitoring server 192.168.1.50 to the Self-IP 192.168.1.1. The rule is placed at the top of the Self-IP rule list. The administrator verifies that the rule is correctly configured and applied. However, SNMP queries from the monitoring server are failing. What is the most likely cause?

   • AThe rule is not applied to the correct VLAN; it should be applied to the VLAN where the monitoring server resides.
   • BThe default Self-IP firewall behavior includes an implicit deny rule for SNMP that is overriding the explicit Accept rule.
   • CThe destination in the rule should be set to 0.0.0.0/0 to cover all Self-IPs.
   • DThere is a conflicting rule earlier in the list that is denying SNMP from the monitoring server.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When creating a firewall rule for a Self-IP, which of the following must be specified in the rule?

   • AThe VLAN ID of the Self-IP
   • BThe SNAT pool to use for the traffic
   • CThe load-balancing algorithm for the Self-IP
   • DThe action (allow or deny) and the source/destination addresses
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the default firewall behavior for Self-IPs on a BIG-IP system?

   • AData-plane traffic is allowed, but management traffic is denied by default
   • BOnly management traffic (e.g., HTTPS, SSH) is implicitly allowed; all other traffic is implicitly denied
   • CAll traffic to and from the Self-IP is implicitly denied
   • DAll traffic to and from the Self-IP is implicitly allowed
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A BIG-IP administrator wants to allow only specific source IPs to access the management Self-IP via SSH. What is the primary reason for implementing a firewall rule for this purpose?

   • ATo enable SNAT for management traffic
   • BTo allow the Self-IP to respond to ICMP echo requests
   • CTo prevent unauthorized management access to the BIG-IP device
   • DTo increase the throughput of the management interface
   Reveal Solution Discussion Select an answer first