A company is deploying ASM in front of a custom Java-based REST API that handles JSON requests. The API is used by a mobile app and a web portal. The security team wants to protect against injection attacks without blocking legitimate JSON payloads. Which signature selection strategy is most appropriate for the initial policy?

Enable signature sets relevant to Java, JSON, and general injection attacks, and disable signatures for technologies not in use.

Enable all signature sets, including those for IIS and Apache, to ensure comprehensive coverage.

Enable only the SQL injection signature set, since JSON APIs commonly interact with databases.

Disable all signatures and rely solely on entity-based violations to protect the API.

Why is it important to include relevant entities in an ASM policy?

To ensure proper coverage of the application's attack surface

To increase the performance of the web server

To reduce the need for signature updates

To simplify the policy's user interface

F5Certified Technology Specialist, BIG-IP ASM (F5-CTS, BIG-IP ASM)

Domain 2Objective 1

Objective 2.01 Determine the Appropriate Criteria for Initial Policy Definition Based on Application Requirements (e.g., Wildcards, Violations, Entities, Signatures, User-Defined Signatures) 303 Practice Questions (Page 2)

Part of the Section 2: Create and customize policies domain, which makes up ~27% of our current practice bank.

14questions here

3free pages

6concepts

Questions 6–10

6application · medium
A company is deploying ASM in front of a custom Java-based REST API that handles JSON requests. The API is used by a mobile app and a web portal. The security team wants to protect against injection attacks without blocking legitimate JSON payloads. Which signature selection strategy is most appropriate for the initial policy?
Select an answer first
7foundation · easy
Which type of violation is detected by the ASM when an attacker attempts to inject SQL code into a parameter?
Select an answer first
8foundation · easy
Which of the following is considered an entity in an ASM policy?
Select an answer first
9foundation · easy
Which violation type is specifically related to the modification of client-side data stored by the application?
Select an answer first
10foundation · easy
Why is it important to include relevant entities in an ASM policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 303

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “303” is a trademark of its owner, used for identification only.

Objective 2.01 Determine the Appropriate Criteria for Initial Policy Definition Based on Application Requirements (e.g., Wildcards, Violations, Entities, Signatures, User-Defined Signatures) 303 Practice Questions (Page 2)

Questions 6–10

Which type of violation is detected by the ASM when an attacker attempts to inject SQL code into a parameter?

Which of the following is considered an entity in an ASM policy?

Which violation type is specifically related to the modification of client-side data stored by the application?

Why is it important to include relevant entities in an ASM policy?

Keep studying — Section 2: Create and customize policies