Explain Use of Groups Using Remote Authentication Provider F5CAB4 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has a strict security policy that requires administrative access to be granted based on the principle of least privilege. They use an LDAP remote authentication provider. The administrator has configured group mappings for 'F5-Admins' to 'admin' and 'F5-Viewers' to 'operator'. A user is a member of both groups. The security team wants the user to have only 'operator' access. What is the best way to achieve this?

   • AModify the BIG-IP configuration to assign the least permissive role when a user is in multiple groups.
   • BChange the mapping for 'F5-Admins' to 'operator'.
   • CRemove the user from the 'F5-Admins' group in LDAP.
   • DCreate a local user account for the user with the 'operator' role.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In F5 BIG-IP, what is the role of group mapping in remote authentication?

   • ATo create a one-to-one correspondence between users and groups.
   • BTo translate remote group names into local BIG-IP group names for role assignment.
   • CTo store group membership information locally on the BIG-IP for faster access.
   • DTo encrypt group membership information during transmission.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How does F5 BIG-IP determine a user's group membership when using a remote authentication provider?

   • ABy reading the group information included in the remote authentication response.
   • BBy analyzing the user's IP address to infer group membership.
   • CBy querying the user's local BIG-IP account for group assignments.
   • DBy requiring the user to manually specify their groups during login.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A BIG-IP administrator is configuring a TACACS+ remote authentication provider. The TACACS+ server returns the group 'Network-Admins' for a user. The administrator has mapped this group to the 'admin' role. However, the user is receiving the 'operator' role. What is the most likely cause?

   • AThe TACACS+ server is returning the group name with a different case than the mapping.
   • BThe TACACS+ provider is not configured to use the group attribute.
   • CThe user has a local BIG-IP account with the 'operator' role.
   • DThe user is also a member of another TACACS+ group that is mapped to 'operator'.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A BIG-IP administrator is using TACACS+ as a remote authentication provider. The TACACS+ server is configured to return the group 'BIG-IP-Admins' for a specific user. The administrator has configured the provider and wants to verify that the user will receive the 'admin' role. Where in the BIG-IP configuration should the administrator check to confirm the group-to-role mapping?

   • AIn the TACACS+ provider configuration, under the group mapping section.
   • BIn the BIG-IP system's hostname configuration.
   • CIn the TACACS+ server's configuration file.
   • DIn the local user database, under the user's account properties.
   Reveal Solution Discussion Select an answer first