Identify HTTP/SSH Access List to management-IP Address F5CAB1 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which command-line utility can be used to verify that a management access list is permitting traffic from a specific source IP?

   • Atraceroute
   • Btmsh
   • Cnetstat
   • Dping
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A BIG-IP administrator is verifying that an HTTP access list is correctly enforcing a security policy. The access list allows 10.0.0.0/8 and denies all others. The administrator tests HTTPS from 10.1.1.1 and is able to connect, and tests from 192.168.1.1 and is blocked. What additional verification should the administrator perform to ensure the access list is working as intended?

   • ATest HTTPS from another host in the 10.0.0.0/8 subnet to confirm the allow rule is consistent.
   • BRestart the BIG-IP device to ensure the access list is fully applied.
   • CReview the access list configuration to confirm the rules are in the correct order.
   • DTest HTTPS from a host in a different disallowed subnet, such as 172.16.0.1, to confirm the deny rule is consistent.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security policy requires that only the IT department's subnet (10.50.0.0/16) can access the BIG-IP management interface via SSH. The administrator configures an SSH access list with an allow rule for 10.50.0.0/16 and a deny-all rule. After binding the list, the administrator tests SSH from a host at 10.50.1.10 and is able to connect. What is the next step to fully verify the access list is working as intended?

   • ATest SSH from a host outside 10.50.0.0/16 and confirm the connection is refused.
   • BRestart the SSH service to ensure the access list is applied.
   • CCreate an HTTP access list with the same rules to ensure both protocols are protected.
   • DReview the access list configuration to ensure the deny-all rule is listed before the allow rule.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An administrator has configured an HTTP access list to allow only 10.0.0.0/8 for management access. After binding the list, the administrator tests from a host at 10.1.1.1 and is able to access the web UI. However, the administrator notices that the access list is not blocking traffic from 192.168.1.1. What is the most likely reason for this?

   • AThe host at 192.168.1.1 is using a different protocol, such as SSH.
   • BThe access list is applied to the data plane instead of the management plane.
   • CThe access list was not bound to the management interface.
   • DThe access list has an implicit allow rule for all traffic.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A BIG-IP administrator is deploying a new device in a shared colocation facility. The security team mandates that only the corporate jump host (IP 10.10.10.10) may reach the management interface over HTTPS, and all other sources must be blocked. The administrator creates an HTTP access list with a rule to allow 10.10.10.10 and a rule to deny all others. What additional configuration is required to ensure the access list is enforced for HTTPS management traffic?

   • ACreate a separate SSH access list and bind it to the management interface.
   • BConfigure a self-IP ACL on the management VLAN to filter inbound HTTPS traffic.
   • CBind the access list to the management interface using the 'modify sys httpd allow' command.
   • DAdd a rule to the HTTP access list to permit traffic from the corporate subnet 10.10.0.0/16.
   Reveal Solution Discussion Select an answer first