A managed service provider (MSP) runs BIG-IP devices for multiple customers. The MSP's monitoring system uses syslog severity levels to trigger alerts. The MSP wants to ensure that any event indicating a potential security breach is logged at a level that will trigger an alert, but they also want to avoid alerting on routine events. The MSP is configuring a custom iRule that logs failed login attempts. The iRule currently logs all failed attempts at 'info' level. The MSP decides to log failed attempts at 'warning' level and escalate to 'alert' after 5 failures from the same IP. What is the primary benefit of this approach?

It ensures that all failed attempts are immediately escalated to the security team.

It reduces alert fatigue while ensuring that potential security breaches are escalated.

It ensures that all failed attempts are logged at the highest severity level.

It eliminates the need for external monitoring of failed login attempts.

A BIG-IP administrator is reviewing the /var/log/ltm log and sees the following entry: '01010001:6: Configuration change accepted.' What does the '6' indicate about this event?

The event is an info-level event.

The event is a warning-level event.

The event is a debug-level event.

The event is a notice-level event.

F5Certified Administrator, BIG-IP

Domain 4Objective 2

Identify Severity Log Level of an Event F5CAB4 Practice Questions (Page 2)

Part of the List which log files could be used to find events and/or hardware issues domain, which makes up ~5% of our current practice bank. F5 does not publish an official question count, but from its 30-minute exam (~10–20 total, ~1–1 in this domain), expect 1–1 from this objective — we provide 12 practice questions to prepare you well beyond it. (estimate)

12questions here

3free pages

3concepts

Questions 6–10

6foundation · easy
Which severity level in F5 BIG-IP logs is used for normal but significant events that do not indicate an error, such as a configuration change or a service restart?
Select an answer first
7foundation · easy
Which severity level is the highest (most severe) in the standard syslog severity hierarchy used by F5 BIG-IP logs?
Select an answer first
8foundation · easy
Given the following log entry from /var/log/ltm: 'err tmm1[1234]: 01260001:3: Pool /Common/pool1 is down.' What is the severity level of this event?
Select an answer first
9expert · hard
A managed service provider (MSP) runs BIG-IP devices for multiple customers. The MSP's monitoring system uses syslog severity levels to trigger alerts. The MSP wants to ensure that any event indicating a potential security breach is logged at a level that will trigger an alert, but they also want to avoid alerting on routine events. The MSP is configuring a custom iRule that logs failed login attempts. The iRule currently logs all failed attempts at 'info' level. The MSP decides to log failed attempts at 'warning' level and escalate to 'alert' after 5 failures from the same IP. What is the primary benefit of this approach?
Select an answer first
10application · medium
A BIG-IP administrator is reviewing the /var/log/ltm log and sees the following entry: '01010001:6: Configuration change accepted.' What does the '6' indicate about this event?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to F5CAB4

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “F5CAB4” is a trademark of its owner, used for identification only.

Identify Severity Log Level of an Event F5CAB4 Practice Questions (Page 2)

Questions 6–10

Which severity level in F5 BIG-IP logs is used for normal but significant events that do not indicate an error, such as a configuration change or a service restart?

Which severity level is the highest (most severe) in the standard syslog severity hierarchy used by F5 BIG-IP logs?

Given the following log entry from /var/log/ltm: 'err tmm1[1234]: 01260001:3: Pool /Common/pool1 is down.' What is the severity level of this event?

A BIG-IP administrator is reviewing the /var/log/ltm log and sees the following entry: '01010001:6: Configuration change accepted.' What does the '6' indicate about this event?

Keep studying — List which log files could be used to find events and/or hardware issues