3.03 Determine the Appropriate Settings to Mitigate Web Fraud 401 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is deploying BIG-IP fraud mitigation and wants to ensure that legitimate users are not blocked due to false positives. They have a diverse user base, including users behind corporate proxies and mobile users on shared IPs. Which approach should they use to minimize false positives?

   • ARequire CAPTCHA for all users who do not have a persistent cookie.
   • BUse a low anomaly detection threshold to catch all potential fraud.
   • CBlock all users who share an IP address with a known attacker.
   • DUse device fingerprinting in combination with behavioral analysis, and avoid relying solely on IP address.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A media company wants to protect its premium content from credential sharing. They want to limit the number of concurrent sessions per user account. Which BIG-IP feature should they configure?

   • ASession tracking with a maximum concurrent sessions per user.
   • BBrowser challenge to verify the user is human.
   • CDevice fingerprinting to identify the user's device.
   • DStep-up authentication for every login.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An e-commerce site is experiencing a high volume of automated login attempts using stolen credentials. The security team wants to detect and block these attempts without affecting legitimate users who occasionally mistype their passwords. Which BIG-IP configuration should they use?

   • ABlock all login attempts after two failed password entries.
   • BEnable behavioral analysis to detect patterns of rapid login failures and trigger a CAPTCHA challenge.
   • CIntegrate with an external fraud feed to block all IP addresses on the feed.
   • DDisable session tracking to reduce the load on the authentication server.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An F5 BIG-IP administrator wants to identify returning users by collecting unique attributes from their devices without requiring them to log in. Which web fraud mitigation setting should be used?

   • ADevice fingerprinting
   • BSession tracking
   • CBrowser challenge
   • DCAPTCHA challenge
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company wants to share device fingerprint data with its external fraud analytics platform to improve fraud detection. Which integration approach should they use?

   • AHave the external platform query BIG-IP's database directly.
   • BConfigure BIG-IP to send device fingerprint data to the external platform via a REST API.
   • CManually export fingerprint data and upload it to the platform.
   • DUse the external platform's webhook to receive alerts from BIG-IP.
   Reveal Solution Discussion Select an answer first