An organization hosts a web application at https://app.example.com. Users authenticate through an APM access policy, and the APM session cookie is set with the default host-only attribute. After a recent update, the application makes cross-origin API calls to https://api.example.com, and users are being prompted to re-authenticate on each API call. Which change should the administrator make to the APM access policy to maintain the user's session across both hosts?

Set the cookie domain to .example.com so the cookie is sent to both app and api hosts.

Set the cookie path to /api so the cookie is sent to the API endpoint.

Enable the 'Secure' flag on the APM session cookie to allow it to be sent over HTTPS to api.example.com.

Configure a separate APM virtual server for api.example.com with its own session cookie.

What is the primary reason APM isolates session cookies between different domains?

To allow the user to have separate login sessions for each domain

To enable the browser to store cookies for a longer period

To prevent a cookie from being sent to a domain that did not set it, enhancing security

To reduce the size of each cookie and improve network performance

An organization has an APM-protected application and wants to prevent automated password guessing attacks. The administrator wants to lock out an IP address after 10 failed login attempts within 5 minutes. Which APM feature should be configured to achieve this?

Session cookie timeout settings.

Multi-domain cookie configuration.

Password guessing mitigation settings.

What is the purpose of throttling login attempts in APM?

To increase the speed of legitimate user logins

To reduce the load on the authentication server

To require users to change their passwords frequently

To slow down the rate at which an attacker can try passwords

What is the purpose of integrating endpoint inspection (such as OPSWAT or registry checks) into an APM access policy?

To verify that the client device meets security requirements before granting access

To speed up the authentication process by caching user credentials on the endpoint

To encrypt all traffic between the endpoint and the APM

To replace the need for user authentication entirely

F5Certified Technology Specialist, BIG-IP APM

Domain 1Objective 3

Objective 1.03 Explain How APM Uses and Manages Session Cookies (domain, Host, Multi-Domain) 304 Practice Questions (Page 2)

Part of the Section 1: Assess security needs and requirements to create an APM policy domain, which makes up ~17% of our current practice bank. F5 does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

5concepts

Questions 6–10

6application · medium
An organization hosts a web application at https://app.example.com. Users authenticate through an APM access policy, and the APM session cookie is set with the default host-only attribute. After a recent update, the application makes cross-origin API calls to https://api.example.com, and users are being prompted to re-authenticate on each API call. Which change should the administrator make to the APM access policy to maintain the user's session across both hosts?
Select an answer first
7foundation · easy
What is the primary reason APM isolates session cookies between different domains?
Select an answer first
8application · medium
An organization has an APM-protected application and wants to prevent automated password guessing attacks. The administrator wants to lock out an IP address after 10 failed login attempts within 5 minutes. Which APM feature should be configured to achieve this?
Select an answer first
9foundation · easy
What is the purpose of throttling login attempts in APM?
Select an answer first
10foundation · easy
What is the purpose of integrating endpoint inspection (such as OPSWAT or registry checks) into an APM access policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 304

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “304” is a trademark of its owner, used for identification only.