Objective 3.01 Interpret Log Entries to Identify Opportunities to Refine the Policy 303 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A BIG-IP ASM log entry shows a violation with an 'enforcement mode' of 'transparent'. What does this indicate about the request?

   • AThe request was allowed to pass through, but the violation was logged.
   • BThe request was sent to a different server.
   • CThe request was blocked by the policy.
   • DThe request was encrypted.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is reviewing an ASM attack log and sees the field "request_uri" with a value of "/login.php?id=1&user=admin". The analyst needs to identify the parameters that were sent in the request. Which field in the log entry provides this information?

   • AThe "support_id" field
   • BThe "request_uri" field
   • CThe "response_code" field
   • DThe "policy_name" field
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An F5 administrator is reviewing ASM logs and sees a violation for "Attack signature detected" with a "signature_name" of "SQL Injection" and a "severity" of "High". The administrator also sees the "enforced" field set to "true" and the "action" field set to "block". The administrator notices that the same signature is also appearing in the logs for requests that are NOT being blocked. What is the most likely explanation?

   • AThe signature is disabled for some requests
   • BThe signature is in staging mode for some requests, while being enforced for others
   • CThe signature is being overridden by a different policy
   • DThe signature is only logging requests from certain IP addresses
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is reviewing ASM logs and sees a violation for "Attack signature detected" with the "staging" field set to "true" and the "action" field set to "log". The analyst also sees the "enforced" field set to "false". The analyst needs to determine if the signature is ready to be moved to blocking mode. What should the analyst do?

   • ADisable the signature entirely
   • BReview the log history for this signature to see if there are any false positives before enabling blocking
   • CIncrease the severity of the signature
   • DImmediately enable blocking for the signature
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An F5 administrator is investigating a security incident and needs to correlate ASM attack logs with system-level events to understand the full scope of the attack. The administrator needs to find the BIG-IP system logs that correspond to the time of the attack. Which log type should the administrator consult?

   • AApplication log
   • BSystem log
   • CPolicy audit log
   • DAttack log
   Reveal Solution Discussion Select an answer first