Objective 2.02 Explain the Policy Builder Lifecycle 303 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An administrator is tuning a BIG-IP ASM policy that has been in learning mode for a month. The learning suggestions show that a certain parameter is frequently flagged, but the application team insists it is legitimate. The administrator wants to reduce false positives without weakening security. What is the most effective action?

   • AAdd the parameter to the allowed list and disable learning for it.
   • BAdjust the parameter's learning settings to be more permissive, then review the impact.
   • CSwitch to enforcement mode and rely on the application team to report issues.
   • DDelete the parameter from the policy entirely.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An administrator is running the policy builder in learning mode. The learning suggestions show that a certain parameter is being flagged as a violation, but the application team confirms it is legitimate. The administrator wants to reduce false positives while still protecting the parameter. What should they do?

   • ASwitch to enforcement mode to stop the noise.
   • BAccept the learning suggestion and add the parameter to the allowed parameters list.
   • CIgnore the learning suggestion and continue learning.
   • DDelete the parameter from the policy.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is deploying BIG-IP ASM for a web application that uses a custom header for authentication. The security team wants to ensure the policy builder learns the expected format of this header. During initial policy creation, what should they do?

   • ADisable learning for the custom header.
   • BIgnore the custom header and rely on default settings.
   • CAdd the custom header to the policy's allowed headers list.
   • DUse a template that includes the custom header.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company has been using a BIG-IP ASM policy for a year. The application has undergone several updates, and the security team has noticed an increase in false positives. They want to maintain the policy's effectiveness. What is the best ongoing maintenance practice?

   • ASet the policy to learning mode permanently.
   • BPeriodically review learning suggestions and update the policy accordingly.
   • COnly update the policy when a security incident occurs.
   • DRecreate the policy from scratch every few months.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During policy tuning, what is the purpose of reviewing learning suggestions?

   • ATo accept or reject suggested changes to the policy
   • BTo delete the policy and start over
   • CTo increase the traffic learning duration
   • DTo change the deployment scenario
   Reveal Solution Discussion Select an answer first