3.01 Apply Procedural Concepts Required to Configure F5 Technology to Provide Network Layer DOS Protection 401 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An F5 administrator has applied a DoS protection profile to a virtual server that fronts a critical application. The profile includes a UDP flood mitigation profile. After a week, the administrator notices that the mitigation is triggering too frequently, causing false positives and dropping legitimate UDP traffic. What should the administrator do to reduce false positives?

   • AApply the DoS profile to a different virtual server that has lower traffic volume.
   • BDisable the UDP flood mitigation profile and rely on the network firewall for protection.
   • CChange the mitigation action to 'drop' instead of 'rate-limit' to be more aggressive.
   • DIncrease the UDP flood detection threshold in the DoS profile to better match the application's normal traffic patterns.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Where in the BIG-IP configuration do you attach a DoS protection profile to protect a specific service?

   • ATo a self IP
   • BTo a node
   • CTo a virtual server
   • DTo a pool member
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After configuring a DoS protection profile on a virtual server, an administrator wants to verify that the mitigation is working correctly and not causing false positives. Which tool or log should the administrator use to check the effectiveness of the DoS protection?

   • AThe DoS protection statistics and logs in the BIG-IP configuration utility.
   • BThe system's syslog messages that show all traffic passing through the virtual server.
   • CThe network packet capture tool on the BIG-IP to analyze all traffic.
   • DThe virtual server's performance graph in the dashboard.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which characteristic is typical of a SYN flood attack?

   • AAttackers send a flood of UDP packets to random ports to exhaust resources.
   • BAttackers send many TCP SYN packets without completing the handshake to exhaust connection table resources.
   • CAttackers send a large number of ICMP echo requests to consume bandwidth.
   • DAttackers send malformed IP fragments to cause reassembly errors.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   After deploying DoS protection, what should you do if legitimate traffic is being blocked?

   • AReduce the thresholds to be more aggressive
   • BDisable the DoS protection profile entirely
   • CIncrease the thresholds to better match the actual traffic baseline
   • DReboot the BIG-IP device
   Reveal Solution Discussion Select an answer first