Objective 3.01 Interpret Log Entries to Identify Opportunities to Refine the Policy 303 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A BIG-IP ASM log entry shows a violation with the name 'HTTP protocol compliance failed'. What does this violation indicate?

   • AThe request contained a SQL injection attack.
   • BThe client's IP address was blocked by the policy.
   • CThe request violated the HTTP protocol compliance rules defined in the security policy.
   • DThe server returned an error response.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst reviews an ASM violation log entry and sees the field "violation_details" containing "Attack signature found: SQLi (signature id 200001234)" with a "support_id" value. The request was NOT blocked, and the "enforced" field shows "false". The analyst needs to confirm whether this signature is currently set to block or only log. Which log field should the analyst examine to make this determination?

   • AThe "signature_names" field within the violation details
   • BThe "policy_name" field to verify which policy generated the log
   • CThe "violation_rating" field to see the severity of the detected attack
   • DThe "enforced" field for the specific attack signature violation
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An F5 administrator is reviewing ASM logs and sees a violation for "Attack signature detected" with a "signature_name" of "Cross-Site Scripting" and a "severity" of "Medium". The administrator also sees the "enforced" field set to "true" and the "action" field set to "block". The administrator needs to determine if this signature is currently blocking requests. What does this log entry indicate?

   • AThe signature is only logging requests because the severity is medium
   • BThe signature is in staging mode and only logging requests
   • CThe signature is actively blocking requests
   • DThe signature is disabled and not evaluating requests
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A BIG-IP ASM log entry shows a violation with the name 'Illegal HTTP status code'. What does this violation indicate?

   • AThe server response contained an invalid header.
   • BThe client sent an HTTP request with an invalid method.
   • CThe server returned an HTTP status code that is not allowed by the security policy.
   • DThe client sent a request with an invalid URI.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which field in a BIG-IP ASM log entry provides a unique identifier that can be used to correlate a specific request across multiple log entries?

   • ASupport ID
   • BRequest
   • CResponse
   • DViolation
   Reveal Solution Discussion Select an answer first