Objective 2.07 Explain Reporting and Remote Logging Capabilities 303 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An administrator is configuring a remote logger for ASM. They have set the IP address and port, but the status shows 'unknown'. What does this status typically indicate?

   • AThe remote logger is accessible and ready.
   • BThe remote logger is configured with an invalid IP address.
   • CThe remote logger has not been tested yet.
   • DThe remote logger is not accessible.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst wants to monitor the ASM's response to attacks. They want to see logs that show the response status codes and any modifications made to the responses by the ASM. Which logging level should they configure?

   • AAll logs
   • BIllegal requests
   • CResponses
   • DSystem logs
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An administrator has configured a remote logger for ASM and set the logging level to 'illegal requests'. They verify that the remote logger status shows 'available' and network connectivity is confirmed. However, they still do not see any logs for requests that were blocked by the WAF. What should the administrator check next?

   • ACheck the ASM policy's logging configuration to ensure that 'illegal requests' is selected for the specific policy being used.
   • BVerify that the remote logger is configured with the correct IP address and port.
   • CEnsure that the BIG-IP's system clock is synchronized with the remote server.
   • DConfirm that the remote syslog server is not blocking the BIG-IP's IP address.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An F5 BIG-IP ASM administrator wants to reduce remote logging volume by sending only requests that were blocked or flagged as suspicious. Which logging level should be configured?

   • AIllegal requests
   • BAll logs
   • CLegal requests
   • DResponses
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team has configured a remote syslog server to receive ASM security logs. After the configuration, they notice that no logs are arriving at the remote server. The BIG-IP ASM policy is active and local logs are being generated correctly. What should the administrator verify FIRST to determine if the remote logger is accessible?

   • ACheck the remote logger's status in the ASM configuration and verify network connectivity from the BIG-IP to the syslog server on the configured port.
   • BReview the ASM policy's logging profiles to ensure that the 'illegal requests' logging level is selected.
   • CConfirm that the BIG-IP's local log storage is not full, which could prevent new logs from being generated.
   • DVerify that the remote syslog server is running a compatible version of the syslog protocol.
   Reveal Solution Discussion Select an answer first