Objective 4.01 Describe the Lifecycle of Attack Signatures 303 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An ASM administrator is reviewing the impact of a signature retirement on their security policy. The retired signature was the only one detecting a specific attack pattern. What is the immediate risk and what should the administrator do?

   • AThe policy loses detection for that attack pattern, so the administrator should check for a replacement signature or implement a custom signature.
   • BThe policy automatically uses a similar signature from the same attack type.
   • CThe policy continues to use the retired signature until the next update.
   • DThe policy's security level is automatically increased to compensate.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is planning to introduce a new signature into their ASM policy. They want to ensure that the signature is fully tested and tuned before it becomes active in enforcement mode. Which sequence of actions best follows the signature lifecycle?

   • ADeploy in staging, review violations, tune exceptions, then move to enforcement.
   • BDeploy in staging, then immediately move to enforcement without tuning.
   • CDisable the signature, then enable it in enforcement after a week.
   • DDeploy in enforcement, then review violations and tune if needed.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a common reason for retiring an attack signature in BIG-IP ASM?

   • AThe administrator wants to reduce the number of signatures
   • BThe signature is too old to be updated
   • CThe signature is causing too many false positives
   • DThe attack pattern is no longer relevant or is covered by a newer signature
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does F5 typically release updates to attack signatures for BIG-IP ASM?

   • AOnly through manual creation by the administrator
   • BVia periodic signature updates that can be downloaded and installed
   • CAs part of the BIG-IP software version upgrade only
   • DThrough automatic updates without any user intervention
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An ASM administrator is reviewing the signature list and finds that a signature has been marked as 'deprecated' by F5. What should the administrator do to maintain the security posture of the policy?

   • AContact F5 support to request an extension for the signature.
   • BRemove the deprecated signature and evaluate if a replacement signature is available.
   • CSet the deprecated signature to staging mode to continue using it.
   • DKeep the deprecated signature in the policy to maintain protection.
   Reveal Solution Discussion Select an answer first