Objective 4.01 Describe the Lifecycle of Attack Signatures 303 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which action is commonly taken during signature tuning to reduce false positives?

   • AIncreasing the signature's sensitivity level
   • BDeleting the signature from the system
   • CSetting the signature to block all requests
   • DSwitching the signature from enforcement to staging mode
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An ASM administrator is reviewing the signature update report and sees that a signature has been retired. What is the most likely reason for this retirement?

   • AThe signature was causing too many false positives and was removed from the system.
   • BThe signature was accidentally deleted during a manual update.
   • CThe signature was not being used by any ASM policy and was removed for efficiency.
   • DThe signature is no longer effective against current attack techniques and has been replaced by a more comprehensive signature.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing the ASM signature update process and wants to understand how F5 decides to create a new attack signature. Which factor is most likely to trigger the creation of a new signature?

   • AA customer requests a signature for a specific application behavior.
   • BA signature generates too many false positives and needs to be rewritten.
   • CA signature reaches its end-of-life date and needs a replacement.
   • DA new vulnerability is disclosed and F5's threat intelligence team develops a signature to detect exploitation attempts.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the correct sequence of stages in the lifecycle of an attack signature in F5 BIG-IP ASM?

   • ATuning, creation, deployment, retirement
   • BDeployment, creation, retirement, tuning
   • CRetirement, creation, deployment, tuning
   • DCreation, deployment, tuning, retirement
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization's ASM policy is configured to automatically update attack signatures. After a scheduled update, the security team observes that a previously allowed request pattern is now being flagged as an attack. What is the most likely reason for this change?

   • AThe update disabled the signature that was previously matching the pattern.
   • BThe update reset the policy's learning mode, causing it to relearn the traffic.
   • CThe update introduced a new signature that matches the pattern, and it was activated in the policy.
   • DThe update changed the policy's enforcement mode from staging to blocking.
   Reveal Solution Discussion Select an answer first