Objective 4.01 Describe the Lifecycle of Attack Signatures 303 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary goal of tuning attack signatures in BIG-IP ASM?

   • ATo reduce false positives while maintaining security
   • BTo disable all signatures to improve performance
   • CTo increase the number of false positives
   • DTo automatically block all traffic
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is experiencing a high rate of false positives from a signature that detects SQL injection. The signature is in enforcement mode and blocking legitimate requests that contain certain keywords. The administrator wants to reduce false positives while keeping the signature active for other requests. What is the best approach?

   • AChange the signature's enforcement mode to staging.
   • BIncrease the signature's severity level to reduce its impact.
   • CAdd an exception for the specific keywords or URL patterns that are causing false positives.
   • DDisable the signature and rely on other SQL injection signatures.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which stage in the attack signature lifecycle involves modifying a signature's settings to reduce false positives?

   • ATuning
   • BRetirement
   • CCreation
   • DDeployment
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An ASM administrator is tuning a signature that is generating false positives on a specific URL. The signature is currently in enforcement mode and blocking legitimate requests. What is the most appropriate way to reduce the false positives while maintaining protection for other URLs?

   • ADisable the signature globally in the policy.
   • BAdd the specific URL to the signature's exception list.
   • CIncrease the signature's accuracy threshold.
   • DChange the signature's enforcement mode to staging.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary source of information that F5 uses to create and update attack signatures for BIG-IP ASM?

   • ARandomly generated patterns from web traffic
   • BThreat intelligence from F5's security research team
   • CCustomer-submitted custom signatures
   • DOpen-source community contributions only
   Reveal Solution Discussion Select an answer first