U/A F5CAB1 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which BIG-IP component can be used to restrict access to a virtual server based on the client's source IP address?

   • ASNAT
   • BPacket filter
   • CVLAN
   • DiRule
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security auditor requires a centralized, tamper-proof record of all configuration changes and administrative logins on a BIG-IP device. The current setup only logs to the local syslog, which the auditor has deemed insufficient. The administrator must ensure logs are sent to a remote SIEM and that the BIG-IP continues to function if the SIEM is unreachable. What is the best configuration?

   • AUse an iRule to send logs to the SIEM over HTTP and disable the local syslog.
   • BConfigure the BIG-IP to send logs via 'High-Speed Logging' (HSL) to the SIEM and disable local logging to save resources.
   • CConfigure a 'Remote Syslog' destination and ensure local logging remains enabled as a fallback.
   • DConfigure the SIEM to pull logs from the BIG-IP via SNMP traps.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A BIG-IP administrator needs to provide a security auditor with a report of all users who have administrative access and their roles. The auditor also wants to see a history of when these users last logged in. What is the most efficient way to gather this information?

   • AUse the 'System > Users' screen in the GUI to view users and their roles, but this does not show login history.
   • BUse the 'tmsh' command to list users and their roles, and check the audit log for login history.
   • CAsk each administrator to provide their own login history.
   • DExport the entire BIG-IP configuration and manually parse the user and role information.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A BIG-IP is load-balancing traffic to a pool of web servers. The security team has identified a specific source IP address that is launching a denial-of-service attack. The administrator needs to immediately block all traffic from this IP address at the BIG-IP level. What is the most direct and effective method?

   • AChange the virtual server's 'Source Address' to the attacker's IP.
   • BSet the 'Connection Limit' on the pool member to zero.
   • CAdd the source IP address to a 'deny' list in the 'Network Firewall' policy applied to the virtual server.
   • DRemove the source IP from the pool's 'Allowed' list.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company wants to integrate BIG-IP administrative authentication with their existing Active Directory (AD) infrastructure. Users should be able to log in to the BIG-IP management interface using their AD credentials. The administrator needs to configure this. What is the first step in this process?

   • AEnable 'Remote Authentication' in the 'System > Platform' settings.
   • BCreate a local user account for each AD user on the BIG-IP.
   • CAssign the 'Administrator' role to the AD group in the BIG-IP user database.
   • DConfigure an 'LDAP' or 'Active Directory' authentication server in the BIG-IP's authentication settings.
   Reveal Solution Discussion Select an answer first