A company is planning to migrate its on-premises applications to the cloud. The current security architecture includes an F5 BIG-IP with ASM for WAF protection and a hardware security module (HSM) for key management. The cloud provider offers a managed WAF service and a cloud HSM. The security team wants to minimize operational overhead while maintaining the same level of security. What is the best approach?

Keep the on-premises BIG-IP and HSM and extend them to the cloud

Use the on-premises BIG-IP for WAF and the cloud HSM for key management

Use the cloud provider's managed WAF and cloud HSM, and decommission the on-premises BIG-IP and HSM

Use the cloud WAF but keep the on-premises HSM

A company is deploying an application that will process personal data of EU citizens. Which regulatory consideration is most likely to impact the security framework selection?

The application must be hosted on-premises to comply with GDPR

The application must implement measures to ensure data protection by design and by default

The application must use a specific encryption algorithm mandated by GDPR

The application must be accessible only from within the EU

A company is designing a security architecture for a new microservices-based application. The application consists of several internal services that communicate with each other and a public-facing API gateway. The security team wants to ensure that internal service-to-service communication is encrypted and authenticated, while the public API is protected from web attacks. Which architecture should be implemented?

Use mutual TLS (mTLS) for service-to-service communication and a WAF in front of the API gateway

Place a WAF between every internal service

Use a single shared API key for all internal services and rely on the network firewall for public protection

Encrypt all traffic with TLS at the load balancer and use basic authentication for internal services

A large enterprise is deploying a new customer portal that will be accessed by millions of users globally. The portal will handle sensitive financial data and must be protected against DDoS attacks and web application attacks. The security team is evaluating two options: (1) an on-premises F5 BIG-IP with ASM and DDoS protection, or (2) a cloud-based CDN with integrated WAF and DDoS protection. The company has a strict budget and wants to minimize capital expenditure. Which option is more appropriate?

Use only network firewalls at the perimeter

A hybrid approach with on-premises WAF and cloud DDoS protection

On-premises BIG-IP with ASM and DDoS protection

Cloud-based CDN with WAF and DDoS protection

F5Certified Solution Expert, Security

Domain 2Objective 3

2.03 Determine the Appropriate Security Framework for an Application 401 Practice Questions (Page 5)

Part of the ARCHITECT SOLUTIONS domain, which makes up ~28% of our current practice bank. F5 does not publish an official question count, but from its 105-minute exam (~40–70 total, ~11–20 in this domain), expect 2–4 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

Questions 21–25

21expert · hard
A company is planning to migrate its on-premises applications to the cloud. The current security architecture includes an F5 BIG-IP with ASM for WAF protection and a hardware security module (HSM) for key management. The cloud provider offers a managed WAF service and a cloud HSM. The security team wants to minimize operational overhead while maintaining the same level of security. What is the best approach?
Select an answer first
22foundation · easy
A company is deploying an application that will process personal data of EU citizens. Which regulatory consideration is most likely to impact the security framework selection?
Select an answer first
23application · medium
A company is designing a security architecture for a new microservices-based application. The application consists of several internal services that communicate with each other and a public-facing API gateway. The security team wants to ensure that internal service-to-service communication is encrypted and authenticated, while the public API is protected from web attacks. Which architecture should be implemented?
Select an answer first
24foundation · easy
An application transmits sensitive data between its web server and users' browsers. Which security framework component is most directly responsible for ensuring the confidentiality of this data in transit?
Select an answer first
25expert · hard
A large enterprise is deploying a new customer portal that will be accessed by millions of users globally. The portal will handle sensitive financial data and must be protected against DDoS attacks and web application attacks. The security team is evaluating two options: (1) an on-premises F5 BIG-IP with ASM and DDoS protection, or (2) a cloud-based CDN with integrated WAF and DDoS protection. The company has a strict budget and wants to minimize capital expenditure. Which option is more appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “401” is a trademark of its owner, used for identification only.

2.03 Determine the Appropriate Security Framework for an Application 401 Practice Questions (Page 5)

Questions 21–25

A company is deploying an application that will process personal data of EU citizens. Which regulatory consideration is most likely to impact the security framework selection?

An application transmits sensitive data between its web server and users' browsers. Which security framework component is most directly responsible for ensuring the confidentiality of this data in transit?

Keep studying — ARCHITECT SOLUTIONS