Objective 2.02 Explain the Policy Builder Lifecycle 303 Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A company is deploying BIG-IP ASM for a new web application that uses both HTTP and HTTPS. The security team wants to ensure the policy builder learns from both protocols. During initial policy creation, what should they configure?

   • AOnly specify HTTPS, as it is more secure.
   • BSpecify both HTTP and HTTPS as the protocols for the virtual server.
   • CSpecify the application language and framework only.
   • DLeave the protocol field blank and let the policy builder auto-detect.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is deploying BIG-IP ASM for a new application that will be available to the public. They have a limited time to deploy and want to ensure the policy is effective from day one. They decide to use the policy builder in learning mode, but they are concerned about the time it takes to build an accurate security model. What is the best way to accelerate the learning process without compromising accuracy?

   • ADeploy the policy in enforcement mode immediately and adjust based on logs.
   • BUse a template as a starting point and then run the policy builder in learning mode to refine it.
   • CManually configure the policy based on the application documentation.
   • DRun the policy builder in learning mode for a shorter period, such as one day.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A large enterprise is deploying BIG-IP ASM for a mission-critical application. The security team has a strict change-management process that requires all policy changes to be approved before going live. They want to use the policy builder to learn from traffic but need to control when the policy transitions to enforcement. What is the best way to achieve this?

   • ARun the policy in enforcement mode from the start and adjust based on logs.
   • BSet the policy builder to automatically switch to enforcement after a set period.
   • CRun the policy builder in learning mode, review suggestions, and manually switch to enforcement after approval.
   • DUse a template and enforce immediately without learning.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company has a BIG-IP ASM policy that has been in production for a year. The security team is planning to migrate the application to a new data center. They want to ensure the policy remains effective during and after the migration. What is the best approach?

   • ACreate a new policy from scratch in the new data center.
   • BDeploy the policy to the new data center and enforce immediately.
   • CLeave the policy in the old data center and rely on other security controls.
   • DExport the policy, deploy it to the new data center, and then run it in learning mode to adapt to any changes.
   Reveal Solution Discussion Select an answer first