A financial services company's web application accepts a 'userID' parameter that is used in SQL queries. An attacker has been observed sending requests with 'userID=1 OR 1=1' and 'userID= alert(1) '. The security team wants to block both attack types while minimizing false positives on legitimate user IDs that are alphanumeric. Which ASM policy configuration should be applied?

Enable the SQL Injection signature set and the XSS signature set, and add a parameter validation rule for 'userID' that allows only alphanumeric characters.

Enable the XSS signature set and configure a URL normalization rule to decode encoded characters in the 'userID' parameter.

Enable the HTTP Parameter Pollution signature set and add a file type validation rule for the 'userID' parameter.

Enable only the SQL Injection signature set and set the enforcement mode to 'Blocking' for the 'userID' parameter.

Which ASM mechanism is primarily responsible for detecting known SQL injection patterns in incoming requests?

Behavioral analysis of user sessions

F5Certified Technology Specialist, BIG-IP ASM (F5-CTS, BIG-IP ASM)

Domain 1Objective 2

Objective 1.02 Explain How Specific Security Policies Mitigate Various Web Application Attacks 303 Practice Questions (Page 5)

Part of the Section 1: Assess security needs and choose an appropriate ASM policy domain, which makes up ~22% of our current practice bank.

31questions here

7free pages

15concepts

15 Concepts in This Objective

SQL Injection Mitigation
Cross-Site Scripting (XSS) Mitigation
Cross-Site Request Forgery (CSRF) Mitigation
Command Injection Mitigation
Path Traversal Mitigation
Remote File Inclusion (RFI) Mitigation
Local File Inclusion (LFI) Mitigation
HTTP Parameter Pollution (HPP) Mitigation
Brute Force Attack Mitigation
Session Hijacking Mitigation
Buffer Overflow Mitigation
XML and Web Service Attack Mitigation
Directory Traversal Mitigation
HTTP Response Splitting Mitigation
File Upload Attack Mitigation

Questions 21–25

21foundation · easy
What does ASM validate to prevent HTTP response splitting attacks?
Select an answer first
22foundation · easy
Which ASM capability helps identify automated brute force attempts?
Select an answer first
23foundation · easy
What does ASM do to mitigate HTTP parameter pollution (HPP) attacks?
Select an answer first
24application · medium
A financial services company's web application accepts a 'userID' parameter that is used in SQL queries. An attacker has been observed sending requests with 'userID=1 OR 1=1' and 'userID=<script>alert(1)</script>'. The security team wants to block both attack types while minimizing false positives on legitimate user IDs that are alphanumeric. Which ASM policy configuration should be applied?
Select an answer first
25foundation · easy
Which ASM mechanism is primarily responsible for detecting known SQL injection patterns in incoming requests?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 303

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “303” is a trademark of its owner, used for identification only.

Objective 1.02 Explain How Specific Security Policies Mitigate Various Web Application Attacks 303 Practice Questions (Page 5)

Questions 21–25

What does ASM validate to prevent HTTP response splitting attacks?

Which ASM capability helps identify automated brute force attempts?

What does ASM do to mitigate HTTP parameter pollution (HPP) attacks?

Which ASM mechanism is primarily responsible for detecting known SQL injection patterns in incoming requests?

Keep studying — Section 1: Assess security needs and choose an appropriate ASM policy