3.01 Apply Procedural Concepts Required to Configure F5 Technology to Provide Network Layer DOS Protection 401 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is preparing for a large marketing event that will cause a significant increase in web traffic. The security team wants to ensure that the F5 DoS protection does not block legitimate users during the event. What should the administrator do before the event?

   • AKeep the current thresholds and monitor the traffic during the event.
   • BDisable the DoS protection profile during the event to avoid any impact.
   • CApply a stricter DoS profile to block any suspicious traffic during the event.
   • DAdjust the DoS protection thresholds to be higher than the expected peak traffic.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the recommended basis for setting initial DoS protection thresholds?

   • AThe vendor's default values without adjustment
   • BThe maximum capacity of the BIG-IP hardware
   • CThe number of pool members
   • DTraffic baselines observed during normal operation
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which F5 tool or feature provides real-time statistics on DoS attacks and mitigations?

   • AThe packet sniffer
   • BThe SNAT pool
   • CThe DoS dashboard in the Configuration utility
   • DThe iRule editor
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A gaming company's UDP-based game server is being flooded with a high volume of UDP packets from spoofed source addresses. The flood is consuming the server's bandwidth and CPU. The F5 administrator needs to mitigate this attack while allowing legitimate game traffic to continue. Which approach should the administrator take?

   • AIncrease the virtual server's UDP idle timeout to allow more connections.
   • BApply a DoS protection profile with a UDP flood mitigation profile and set the action to 'rate-limit'.
   • CEnable SYN cookie protection on the virtual server.
   • DBlock all UDP traffic to the virtual server using a firewall rule.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator observes a large number of TCP SYN packets sent to a web server, but the server's SYN-ACK responses are not being completed. The server's connection table is filling up, causing legitimate connections to be dropped. Which type of attack is this, and which F5 feature should be used to mitigate it?

   • ASYN flood; enable SYN cookie protection on the virtual server.
   • BUDP flood; enable UDP flood mitigation in the DoS profile.
   • CICMP flood; enable ICMP flood mitigation in the DoS profile.
   • DPing of death; enable IP fragmentation protection.
   Reveal Solution Discussion Select an answer first