Port Lockdown F5CAB1 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A BIG-IP administrator is troubleshooting a connectivity issue. A self-IP has port lockdown set to Allow Default, but a network engineer reports that they cannot SSH to the BIG-IP using that self-IP. The administrator confirms that SSH is included in the Allow Default service list. What is the most likely reason for the SSH failure?

   • AThe self-IP is not configured with a management IP address
   • BThe SSH service is not actually included in the Allow Default list
   • CThe network engineer is connecting from a source IP that is blocked by a separate firewall rule
   • DPort lockdown only affects traffic from external networks, not internal traffic
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security audit requires that all self-IPs on a BIG-IP device have port lockdown enabled and that only necessary services are allowed. The auditor finds that one self-IP has port lockdown set to Allow All. The administrator argues that this self-IP is only used for application traffic and does not expose management services. What is the best response to this argument?

   • AAllow All is acceptable because application traffic is not sensitive
   • BAllow All is a security risk because it permits management protocols on the self-IP
   • CAllow All is required for application traffic to function
   • DAllow All is acceptable because the self-IP is not reachable from external networks
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An administrator needs to allow a specific management tool to access the BIG-IP on TCP port 8443, but only from a single management server. The administrator also wants to allow ICMP for troubleshooting. The administrator has set port lockdown to Allow None and added a custom rule for port 8443 from the management server's IP. However, ping to the self-IP is still failing. What should the administrator do to allow ICMP?

   • AChange the port lockdown mode to Allow All
   • BChange the port lockdown mode to Allow Default
   • CAdd a custom rule for ICMP to the existing Allow None configuration
   • DRemove the custom rule for port 8443 and add a rule for ICMP
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the effect of a custom port lockdown rule that allows TCP port 8443 on a self-IP?

   • AAll traffic to the self-IP is allowed because a custom rule is present
   • BTCP and UDP traffic to port 8443 are both allowed
   • COnly TCP traffic to port 8443 is permitted; all other TCP and UDP traffic is denied
   • DAll TCP traffic is permitted, and UDP traffic to port 8443 is also allowed
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the BIG-IP Configuration utility, where would you navigate to change the port lockdown setting for a self-IP?

   • ALocal Traffic → Virtual Servers
   • BNetwork → Self IPs
   • CDevice Management → Devices
   • DSystem → Platform
   Reveal Solution Discussion Select an answer first