Explain Use of Groups Using Remote Authentication Provider F5CAB4 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A BIG-IP administrator is troubleshooting an issue where a user authenticated via LDAP is not receiving the expected 'admin' role. The user is a member of the 'BIG-IP-Admins' group in LDAP. The administrator has verified that the group mapping is correct. What is the most likely cause of the issue?

   • AThe user is not a member of the 'admin' group in BIG-IP.
   • BThe LDAP provider is not configured to return group membership information.
   • CThe user's password is incorrect.
   • DThe BIG-IP device is not licensed for LDAP authentication.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has multiple BIG-IP devices. They use a single Active Directory domain as the remote authentication provider. The administrator wants users in the 'BIG-IP-Prod-Admins' group to have 'admin' access on production devices, but only 'operator' access on development devices. What is the most efficient way to achieve this?

   • AAssign the 'admin' role to the group on all devices and rely on the firewall to restrict access.
   • BConfigure different group mappings on each BIG-IP device's remote authentication provider.
   • CCreate two separate AD groups and assign users to the appropriate one.
   • DUse a single mapping on all devices and change the role in the AD group properties.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of using groups from a remote authentication provider in F5 BIG-IP administration?

   • ATo allow the BIG-IP to authenticate users without contacting the remote server.
   • BTo encrypt all communication between the BIG-IP and the remote authentication server.
   • CTo simplify the management of administrative permissions by assigning roles to groups rather than individual users.
   • DTo provide a backup of the BIG-IP configuration in case of system failure.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization is migrating from local BIG-IP user accounts to a centralized RADIUS authentication provider. The RADIUS server is already used for network device access and returns a group attribute. The BIG-IP administrator has configured the provider and mapped the group 'NetOps' to the 'operator' role. However, during testing, a user in the 'NetOps' group is receiving the 'admin' role. What is the most likely cause?

   • AThe RADIUS server is not returning the group attribute correctly.
   • BThe user is also a member of another RADIUS group that is mapped to 'admin'.
   • CThe BIG-IP administrator mistakenly assigned the 'admin' role to the 'NetOps' group.
   • DThe user has a local BIG-IP account with the 'admin' role.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A BIG-IP administrator is configuring LDAP as a remote authentication provider. The company's LDAP directory has a group called 'F5-Admins' that should have full administrative access, and a group called 'F5-Viewers' that should have read-only access. The administrator has already configured the LDAP server connection. What is the next step to ensure users in these groups receive the correct permissions?

   • AAssign the roles directly to the LDAP server object in BIG-IP.
   • BModify the LDAP directory to change the group names to 'admin' and 'operator'.
   • CConfigure group-to-role mappings for 'F5-Admins' to 'admin' and 'F5-Viewers' to 'operator'.
   • DCreate local user accounts for each member of 'F5-Admins' and 'F5-Viewers'.
   Reveal Solution Discussion Select an answer first