A company is deploying BIG-IP APM to control access to an internal web application. They want to grant access only to users who are members of the 'Finance-App-Users' Active Directory group. The APM administrator has already configured the AD authentication server and created an access profile. What is the next step to enforce this group-based access?

Create a per-session policy that checks the user's group membership and assigns the appropriate resource.

Assign the 'Finance-App-Users' group to the web application's virtual server in the APM profile.

Configure the AD server to only return users from the 'Finance-App-Users' group during authentication.

Add the 'Finance-App-Users' group to the 'Allowed Groups' list in the access profile's general settings.

An administrator has configured a group mapping rule in the access policy. They want to test the mapping without affecting production users. What is the best approach?

Create a test user in AD and assign them to the group, then test with that user.

Disable the production access policy and enable a test policy.

Use the BIG-IP's built-in simulation tool to test the policy.

Temporarily add a test user to the production group and then remove them.

An organization has a complex AD structure with many nested groups. They want to map a top-level group to a resource, but they also want to include users from nested groups. Which method should they use to ensure all nested group members are included?

Configure the AD query to retrieve nested group memberships, then use the group name in the mapping rule.

Use the group SID in the mapping rule, as SIDs are resolved to include nested groups.

Use the group name in the mapping rule, as APM automatically includes nested groups.

Create a separate mapping rule for each nested group.

An administrator needs to map a group that has a space in its name, such as 'Finance Users', to a resource. What is a consideration when using the group name in the mapping rule?

Group names with spaces are not supported in APM group mapping.

You must use the SID instead of the name if the group name has spaces.

The group name must be entered exactly as it appears in AD, including spaces.

You must escape the space with a backslash in the rule.

How does BIG-IP APM retrieve Active Directory group memberships for a user during authentication?

By querying the Active Directory server using LDAP after the user authenticates

By using the user's SAML assertion to extract group claims

By parsing the user's Kerberos ticket for group SIDs

By reading the user's token from the local APM database

F5Certified Technology Specialist, BIG-IP APM

Domain 2Objective 19

Objective 2.19 Describe Methods to Map Microsoft Active Directory Groups to Assigned Resources 304 Practice Questions (Page 3)

Part of the Section 2: Configure and deploy an access profile domain, which makes up ~56% of our current practice bank. F5 does not publish an official question count, but from its 90-minute exam (~35–60 total, ~20–34 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

5concepts

Questions 11–15

11application · medium
A company is deploying BIG-IP APM to control access to an internal web application. They want to grant access only to users who are members of the 'Finance-App-Users' Active Directory group. The APM administrator has already configured the AD authentication server and created an access profile. What is the next step to enforce this group-based access?
Select an answer first
12application · medium
An administrator has configured a group mapping rule in the access policy. They want to test the mapping without affecting production users. What is the best approach?
Select an answer first
13application · medium
An organization has a complex AD structure with many nested groups. They want to map a top-level group to a resource, but they also want to include users from nested groups. Which method should they use to ensure all nested group members are included?
Select an answer first
14application · medium
An administrator needs to map a group that has a space in its name, such as 'Finance Users', to a resource. What is a consideration when using the group name in the mapping rule?
Select an answer first
15foundation · easy
How does BIG-IP APM retrieve Active Directory group memberships for a user during authentication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 304

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “304” is a trademark of its owner, used for identification only.