Objective 4.02 Evaluate the Impact of New or Updated Attack Signatures on Existing Security Policies 303 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a BIG-IP ASM policy that is currently in staging mode. A new signature update is applied to the system. The security team wants to update the policy to include the new signatures and then move it to enforcement mode. However, they are concerned about the impact on production traffic. What is the best approach to minimize risk?

   • ADo not update the policy until the next scheduled maintenance window
   • BUpdate the policy and immediately switch to enforcement mode
   • CUpdate the policy, keep it in staging mode, monitor for false positives, then switch to enforcement
   • DUpdate the policy and enforce it only during off-peak hours
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security administrator has applied a signature fix to correct a signature that was incorrectly blocking a specific type of request. After applying the fix, the administrator wants to verify that the fix is effective in the production policy. What should the administrator do?

   • ASend a test request that was previously blocked and check if it is now allowed
   • BCheck the signature's version in the system's signature database
   • CReview the ASM audit log for the fix application
   • DReboot the BIG-IP device to ensure the fix is loaded
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An administrator has applied a signature fix to address a false negative issue. After applying the fix and updating the policy, the administrator notices that the policy is now blocking legitimate traffic that was previously allowed. What is the most likely cause?

   • AThe policy's enforcement mode was changed to blocking
   • BThe fix introduced a new false positive
   • CThe fix was applied to the wrong signature
   • DThe policy was not enforced after the update
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company has a policy that has been in production for months. The security team has just applied a new signature update and a signature fix to the BIG-IP system. The team needs to ensure the production policy reflects both changes. What is the correct sequence of actions?

   • AApply the update, update the policy, then apply the fix
   • BApply the update, apply the fix, then update the policy
   • CUpdate the policy first, then apply the update and fix
   • DApply the fix, update the policy, then apply the update
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team manages a BIG-IP ASM policy that is currently in enforcement mode. A new signature update is released, and the team applies it to the system. However, they do not want the new signatures to be enforced immediately because they want to monitor for false positives. What should the team do?

   • AUpdate the policy to associate the new signatures but keep the policy in staging mode
   • BApply the update and immediately enforce the policy
   • CDo not update the policy until the next maintenance window
   • DDisable the new signatures in the policy
   Reveal Solution Discussion Select an answer first