Firewall Rules for Self-IPs F5CAB1 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A BIG-IP Administrator is setting up a new BIG-IP device and needs to ensure that the Self-IP on the external VLAN is reachable for HTTPS management (port 443) from the corporate network 203.0.113.0/24. The administrator also wants to block all other management access to this Self-IP. The administrator creates a rule to allow HTTPS from the corporate network and places it at the top of the Self-IP rule list. What else must the administrator do to ensure the requirement is met?

   • AApply the rule to the management VLAN instead of the external VLAN.
   • BEnsure the Self-IP is on the same VLAN as the corporate network.
   • CAdd a Deny rule for all other sources and ports below the Accept rule.
   • DChange the rule action to 'Reject' to block all other traffic.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An administrator has configured a Self-IP firewall rule to allow HTTPS (port 443) from a specific management subnet to the Self-IP. After applying the rule, the administrator wants to verify that the rule is working correctly. Which method should the administrator use to confirm that the rule is being applied?

   • AReview the BIG-IP configuration file for the rule.
   • BCheck the BIG-IP firewall rule statistics to see if the rule has matched traffic.
   • CPing the Self-IP from the management subnet to test connectivity.
   • DRestart the BIG-IP device to apply the rule.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An administrator is configuring Self-IP firewall rules on a BIG-IP device. The requirement is to allow SSH (port 22) from the admin subnet 10.20.0.0/24 to the Self-IP 10.20.0.1, and to allow HTTPS (port 443) from the monitoring subnet 10.30.0.0/24 to the same Self-IP. All other management access must be blocked. The administrator creates three rules: Rule 1 (Accept SSH from 10.20.0.0/24), Rule 2 (Accept HTTPS from 10.30.0.0/24), and Rule 3 (Deny all other traffic). What is the correct order for these rules?

   • ARule 1, Rule 2, Rule 3.
   • BRule 3, Rule 1, Rule 2.
   • CRule 1, Rule 3, Rule 2.
   • DThe order does not matter because the most specific rule is always applied.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which BIG-IP tool or feature can be used to verify that a Self-IP firewall rule is being applied to traffic?

   • AThe virtual server statistics
   • BThe SNAT map
   • CThe packet trace (tcpdump) utility
   • DThe DNS resolver cache
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the BIG-IP Configuration utility, where would an administrator go to create a firewall rule that applies to a Self-IP?

   • ANetwork → Self IPs → [Self-IP] → Firewall Rules
   • BLocal Traffic → Virtual Servers → [Virtual Server] → Security
   • CSystem → Platform → Management Ports
   • DDevice Management → NTP → Firewall
   Reveal Solution Discussion Select an answer first