An administrator is troubleshooting an SSH lockout on a BIG-IP. The SSHD ACL rules are: Rule 1: allow 10.0.0.0/8; Rule 2: deny 0.0.0.0/0. The administrator's workstation is at 10.1.1.1, but SSH connections are failing. What is the most likely cause?

The allow rule is misconfigured and does not include the correct netmask.

The deny-all rule is overriding the allow rule.

The workstation is within the allowed subnet, so the allow rule should match first and permit the connection.

The SSH service on the BIG-IP is not running.

What is the most direct method to verify that an SSHD ACL is correctly allowing a specific source?

Attempt an SSH connection from that source and confirm it succeeds

Check the BIG-IP system log for ACL rule matches

Review the ACL configuration in the web UI

Ping the BIG-IP management IP from that source

What elements are used to define an SSHD ACL rule?

VLAN, route domain, and packet size

Source IP address, netmask, and optional port

Destination IP address, protocol, and interface

Username, password, and authentication method

A company has a BIG-IP device that is accessible via SSH from the internet. The security team wants to reduce the attack surface by restricting SSH access to the management interface. What is the primary purpose of configuring SSHD ACLs in this scenario?

To encrypt SSH traffic between clients and the BIG-IP.

To limit SSH access to only trusted source IP addresses.

To prevent brute-force attacks by limiting login attempts.

To log all SSH connection attempts to the BIG-IP.

An administrator needs to configure SSHD ACLs to allow SSH access from the 10.20.30.0/24 subnet and deny all other sources. The administrator is using tmsh. Which command sequence should be used?

Create an allow rule for 10.20.30.0/24, then create a deny rule for 0.0.0.0/0, ensuring the allow rule is first.

Create only an allow rule for 10.20.30.0/24 and do not create any deny rules.

Create only a deny rule for 0.0.0.0/0 and do not create any allow rules.

Create a deny rule for 0.0.0.0/0, then create an allow rule for 10.20.30.0/24, ensuring the deny rule is first.

F5Certified Administrator, BIG-IP

Domain 1Objective 6

SSHD ACLs F5CAB1 Practice Questions (Page 4)

Part of the Securing BIG-IP domain, which makes up ~29% of our current practice bank. F5 does not publish an official question count, but from its 30-minute exam (~10–20 total, ~3–6 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

Questions 16–20

16expert · hard
An administrator is troubleshooting an SSH lockout on a BIG-IP. The SSHD ACL rules are: Rule 1: allow 10.0.0.0/8; Rule 2: deny 0.0.0.0/0. The administrator's workstation is at 10.1.1.1, but SSH connections are failing. What is the most likely cause?
Select an answer first
17foundation · easy
What is the most direct method to verify that an SSHD ACL is correctly allowing a specific source?
Select an answer first
18foundation · easy
What elements are used to define an SSHD ACL rule?
Select an answer first
19application · easy
A company has a BIG-IP device that is accessible via SSH from the internet. The security team wants to reduce the attack surface by restricting SSH access to the management interface. What is the primary purpose of configuring SSHD ACLs in this scenario?
Select an answer first
20application · medium
An administrator needs to configure SSHD ACLs to allow SSH access from the 10.20.30.0/24 subnet and deny all other sources. The administrator is using tmsh. Which command sequence should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to F5CAB1

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “F5CAB1” is a trademark of its owner, used for identification only.