Objective 4.01 Describe the Lifecycle of Attack Signatures 303 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In which mode does an attack signature actively block or alert on matching traffic in a security policy?

   • ALearning mode
   • BEnforcement mode
   • CStaging mode
   • DPassive mode
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is evaluating the risk of relying solely on F5's signature updates for their ASM protection. They are concerned about the time between a new attack being discovered and the release of a signature. What is the most effective way to mitigate this gap?

   • ADisable signature enforcement and rely on manual traffic review.
   • BIncrease the frequency of signature updates to daily.
   • CCreate custom signatures for every new vulnerability immediately.
   • DImplement additional security controls such as bot defense and behavioral analysis.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An ASM administrator is troubleshooting a high number of false positives from a signature that was recently moved to enforcement mode. The signature is detecting a pattern that appears in legitimate user input. The administrator has already created an exception for the specific parameter, but the false positives continue. What is the most likely reason and what should the administrator do next?

   • AThe signature is in staging mode and the exception is not effective in staging.
   • BThe exception is not being applied because the signature is also triggered by other parameters; review the violation details to identify all triggering parameters and add exceptions for them.
   • CThe signature is a custom signature and exceptions do not work for custom signatures.
   • DThe exception was created incorrectly and needs to be recreated.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A web application team reports that a specific attack signature is blocking legitimate requests that contain a certain string. The ASM administrator needs to allow this string while keeping the signature active for other requests. What is the most efficient way to achieve this?

   • ADisable the signature in the policy.
   • BCreate a signature exception for the specific string.
   • CChange the signature's enforcement mode to staging.
   • DModify the signature's attack type to a less severe one.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An ASM administrator is managing a policy that has a mix of signatures in staging and enforcement modes. The administrator wants to move a signature from staging to enforcement, but is concerned about potential false positives. What is the best way to assess the risk before moving the signature to enforcement?

   • AMove the signature to enforcement and monitor the logs for false positives, then tune if needed.
   • BKeep the signature in staging indefinitely to avoid any risk.
   • CAsk F5 support for a recommendation on whether to enforce the signature.
   • DReview the violation logs from the staging period to identify any false positives and tune exceptions before moving to enforcement.
   Reveal Solution Discussion Select an answer first