F5Certified Technology Specialist, BIG-IP ASM (F5-CTS, BIG-IP ASM)
Domain 4Objective 5
Objective 4.05 Identify and Gather Information Relevant to Evaluating the Activity of an ASM Implementation 303 Practice Questions (Page 5)
Part of the Section 4: Administer and evaluate ASM implementation domain, which makes up ~42% of our current practice bank.
27questions here
6free pages
6concepts
Questions 21–25
- 21
An application team reports that a specific legitimate user workflow is being blocked by the ASM. The security admin needs to determine if this is a false positive or a real attack. The admin has access to the ASM event logs. Which specific log entry should the admin examine to make this determination?
Select an answer first - 22
When evaluating ASM event logs to assess policy effectiveness, which log entry is most relevant for understanding why a request was blocked?
Select an answer first - 23
A security analyst is investigating a spike in 404 errors on the web server. The ASM event logs show a high number of 'Illegal Parameter' violations from a single IP address. The analyst wants to determine if this is a targeted attack or just a misconfigured client. Which piece of information from the event logs would be most useful for this determination?
Select an answer first - 24
A manager wants a weekly report showing the top 10 attack vectors targeting the company's web applications. The security team uses the ASM reporting tools. Which report should be configured to provide this information most directly?
Select an answer first - 25
An admin is investigating a series of 'HTTP Protocol Compliance' violations. The admin wants to know if these violations are coming from a specific client or are spread across many clients. Which field in the ASM event log should the admin use to group the violations for this analysis?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “303” is a trademark of its owner, used for identification only.