A BIG-IP administrator is configuring a new device and wants to restrict management access to the device's management IP address. The administrator plans to use access lists for both HTTP and SSH. What is the primary reason for using separate access lists for HTTP and SSH?

HTTP access lists are used for web UI access, while SSH access lists are used for API access.

HTTP access lists are applied to the management interface, while SSH access lists are applied to the data plane.

SSH access lists are required for command-line access, while HTTP access lists are optional.

HTTP and SSH use different ports, so separate lists allow independent control over each protocol.

After configuring a management access list to deny a specific source IP, what is the most direct way to verify that the rule is enforced?

Review the access list configuration in tmsh

Attempt an SSH connection from that source IP and observe if it is refused

Check the BIG-IP system log for the rule

Ping the management IP from that source

A security audit requires that only the management subnet (172.16.0.0/24) can access the BIG-IP management interface via HTTPS. The administrator creates an HTTP access list with a rule to allow 172.16.0.0/24 and a rule to deny all others. After binding the list, the administrator tests from a host at 172.16.0.100 and is able to connect. What should the administrator do next to ensure the deny rule is also effective?

Review the access list configuration to confirm the deny rule is listed before the allow rule.

Test HTTPS access from a host outside 172.16.0.0/24 and confirm the connection is refused.

Create an SSH access list with the same rules to ensure both protocols are protected.

Reboot the BIG-IP device to ensure the access list is fully applied.

F5Certified Administrator, BIG-IP

Domain 2Objective 5

Identify HTTP/SSH Access List to management-IP Address F5CAB1 Practice Questions (Page 3)

Part of the Identify management connectivity configurations domain, which makes up ~19% of our current practice bank. F5 does not publish an official question count, but from its 30-minute exam (~10–20 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

3concepts

Questions 11–13

11application · medium
A BIG-IP administrator is configuring a new device and wants to restrict management access to the device's management IP address. The administrator plans to use access lists for both HTTP and SSH. What is the primary reason for using separate access lists for HTTP and SSH?
Select an answer first
12foundation · easy
After configuring a management access list to deny a specific source IP, what is the most direct way to verify that the rule is enforced?
Select an answer first
13application · medium
A security audit requires that only the management subnet (172.16.0.0/24) can access the BIG-IP management interface via HTTPS. The administrator creates an HTTP access list with a rule to allow 172.16.0.0/24 and a rule to deny all others. After binding the list, the administrator tests from a host at 172.16.0.100 and is able to connect. What should the administrator do next to ensure the deny rule is also effective?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to F5CAB1

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “F5CAB1” is a trademark of its owner, used for identification only.

Identify HTTP/SSH Access List to management-IP Address F5CAB1 Practice Questions (Page 3)

Questions 11–13

A BIG-IP administrator is configuring a new device and wants to restrict management access to the device's management IP address. The administrator plans to use access lists for both HTTP and SSH. What is the primary reason for using separate access lists for HTTP and SSH?

After configuring a management access list to deny a specific source IP, what is the most direct way to verify that the rule is enforced?

Keep studying — Identify management connectivity configurations