Objective 2.02 Explain the Policy Builder Lifecycle 303 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An administrator is reviewing learning suggestions from a BIG-IP ASM policy that has been in learning mode for several weeks. They notice that a particular attack signature is being triggered frequently, but the application team says it is a false positive caused by a legitimate feature. The administrator wants to reduce the noise while still protecting against the attack. What is the best action?

   • ADisable the attack signature globally.
   • BSwitch to enforcement mode to stop the noise.
   • CIgnore the learning suggestion and leave the signature enabled.
   • DDisable the specific attack signature for the affected URL.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After the policy builder has been learning for several weeks, the administrator reviews the learning suggestions and finds that a particular URL is being flagged as a violation, but it is a legitimate endpoint. The administrator wants to ensure this URL is not blocked in the future. What should they do?

   • ADelete the learning suggestion and ignore the URL.
   • BChange the enforcement mode to transparent for this URL.
   • CDisable the security policy for the entire application.
   • DAccept the learning suggestion and add the URL to the allowed URLs list.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What happens when a BIG-IP ASM policy transitions from learning mode to enforcement mode?

   • AThe policy stops learning and deletes all learned data
   • BThe policy automatically updates its signatures
   • CThe policy reverts to the initial creation settings
   • DThe policy begins to block or alert on violations based on the learned model
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which action is part of refining a policy based on learning results?

   • AAdjusting entity settings such as URLs and parameters
   • BDeleting the virtual server
   • CDisabling the security policy entirely
   • DChanging the BIG-IP hardware model
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of the traffic learning phase in the BIG-IP ASM policy builder?

   • ATo build a security model of normal application behavior
   • BTo block malicious traffic immediately
   • CTo delete all existing security policies
   • DTo generate a compliance report
   Reveal Solution Discussion Select an answer first