Objective 3.01 Interpret Log Entries to Identify Opportunities to Refine the Policy 303 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is reviewing an ASM attack log and sees a violation for "Attack signature detected" with a "severity" of "High" and a "confidence" of "Low". The analyst also sees the "enforced" field set to "true" and the "action" field set to "block". The analyst needs to determine if this is a true positive or a false positive. What should the analyst do?

   • AIgnore the log entry because the confidence is low
   • BIncrease the confidence threshold for the signature to reduce false positives
   • CImmediately disable the signature to prevent further false positives
   • DReview the full request payload and response in the log to determine if the signature match is legitimate
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An F5 administrator is reviewing ASM logs and sees a violation for "Illegal parameter value" on a parameter named "id". The "enforced" field is set to "true" and the "action" field is set to "block". The administrator notices that legitimate requests with numeric IDs are being blocked, while requests with alphanumeric IDs are allowed. The administrator needs to refine the policy to allow numeric IDs while still blocking malicious payloads. What should the administrator do?

   • AIncrease the violation rating for this parameter
   • BModify the parameter's data type to 'integer' and update the allowed pattern to match numeric values
   • CSet the parameter to 'allow all' in the policy
   • DDisable the violation for this parameter entirely
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing an ASM violation log and sees the entry "Violation: Illegal parameter value" with a "parameter_name" of "userid" and a "parameter_value" of "admin' OR '1'='1". The analyst needs to determine the likely attack type. What does this log entry indicate?

   • AA SQL injection attempt
   • BA cross-site scripting (XSS) attempt
   • CA command injection attempt
   • DA directory traversal attempt
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team needs to review a history of changes made to the ASM policy, including who made the changes and when. The team wants to understand why a specific signature was disabled. Which ASM log type should they consult?

   • AApplication log
   • BPolicy audit log
   • CTraffic log
   • DAttack log
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which BIG-IP ASM log type is primarily used to record administrative changes to the security policy, such as modifying a signature or adding a new URL?

   • APolicy log
   • BAttack log
   • CAudit log
   • DRequest log
   Reveal Solution Discussion Select an answer first