A web application has a URL /admin that should only be accessible from internal IP addresses. The ASM policy is in blocking mode. You need to enforce this access control. What should you configure?

Create a header policy that requires a specific header for /admin.

Create a URL policy for /admin and set the allowed source IP addresses.

Use the anomaly detection to block requests from external IPs.

Disable the /admin URL in the policy.

When customizing a content profile for JSON, what is a typical configuration you might adjust?

The maximum nesting depth of JSON objects

The HTTP method allowed for the URL

The SSL cipher suite for the connection

What is the primary function of an ASM header policy?

To control the order of HTTP methods

To manage SSL certificates for secure communication

To define the content type of the response body

To inspect and enforce rules on request and response headers

A web application experiences periodic traffic spikes that are legitimate, but the ASM policy is blocking requests during these spikes because the anomaly detection threshold is too low. You need to allow the legitimate traffic while still protecting against real attacks. What should you configure?

Increase the anomaly detection threshold to accommodate the traffic spikes.

Disable anomaly detection entirely.

Create a URL policy that excludes the affected URLs from anomaly detection.

Use the learning mode to automatically adjust the threshold.

A web application uses a custom header 'X-Client-Version' to indicate the client version. The application only supports versions 1.0, 1.1, and 2.0. Clients with other versions should be blocked. The ASM policy is in blocking mode. What should you configure to enforce this?

Create a URL policy that blocks any request without the 'X-Client-Version' header.

Disable header checking for this application to avoid false positives.

Create a header policy for 'X-Client-Version' and set the allowed values to '1.0', '1.1', and '2.0'.

Create a parameter policy for the header 'X-Client-Version'.

F5Certified Technology Specialist, BIG-IP ASM (F5-CTS, BIG-IP ASM)

Domain 2Objective 4

Objective 2.04 Refine Policy Structure for Policy Elements (e.g., URLs, Parameters, Files Types, Headers, Sessions and Logins, Content Profiles, CSRF Protection, Anomaly Protection) 303 Practice Questions (Page 4)

Part of the Section 2: Create and customize policies domain, which makes up ~27% of our current practice bank.

24questions here

5free pages

8concepts

Questions 16–20

16application · medium
A web application has a URL /admin that should only be accessible from internal IP addresses. The ASM policy is in blocking mode. You need to enforce this access control. What should you configure?
Select an answer first
17foundation · easy
When customizing a content profile for JSON, what is a typical configuration you might adjust?
Select an answer first
18foundation · easy
What is the primary function of an ASM header policy?
Select an answer first
19application · medium
A web application experiences periodic traffic spikes that are legitimate, but the ASM policy is blocking requests during these spikes because the anomaly detection threshold is too low. You need to allow the legitimate traffic while still protecting against real attacks. What should you configure?
Select an answer first
20application · medium
A web application uses a custom header 'X-Client-Version' to indicate the client version. The application only supports versions 1.0, 1.1, and 2.0. Clients with other versions should be blocked. The ASM policy is in blocking mode. What should you configure to enforce this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 303

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “303” is a trademark of its owner, used for identification only.