A company wants to prevent their web application from being attacked by common web exploits such as cross-site scripting and SQL injection. They have no specific compliance requirement, but they want to improve their security posture. Which F5 control should they implement?

BIG-IP DNS to filter malicious domains

BIG-IP LTM with a client SSL profile

BIG-IP ASM with a security policy

BIG-IP APM with an access policy

A financial services company wants to reduce the risk of credential theft for their customer portal. They are not currently subject to any specific regulation that mandates multi-factor authentication, but they want to improve security as a business best practice. Which F5 control should they implement?

Configure an Access Policy that requires multi-factor authentication

Apply a client SSL profile to the portal virtual server

Configure an iRule to rate-limit login attempts

Enable the BIG-IP ASM bot detection feature

After configuring a new WAF policy to block SQL injection, a security analyst wants to ensure that the policy is not causing false positives that block legitimate traffic. Which approach would best validate this?

Send a known SQL injection payload and verify it is blocked

Check the policy's enforcement mode is set to blocking

Review the WAF logs for blocked requests

Run the policy in transparent mode for a period and analyze the logs

F5Certified Solution Expert, Security

Domain 2Objective 2

2.02 Determine the Correct Control to Address a Compliance or Business Requirement 401 Practice Questions (Page 4)

Part of the ARCHITECT SOLUTIONS domain, which makes up ~28% of our current practice bank. F5 does not publish an official question count, but from its 105-minute exam (~40–70 total, ~11–20 in this domain), expect 2–4 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

Questions 16–20

16application · easy
A company wants to prevent their web application from being attacked by common web exploits such as cross-site scripting and SQL injection. They have no specific compliance requirement, but they want to improve their security posture. Which F5 control should they implement?
Select an answer first
17application · medium
A financial services company wants to reduce the risk of credential theft for their customer portal. They are not currently subject to any specific regulation that mandates multi-factor authentication, but they want to improve security as a business best practice. Which F5 control should they implement?
Select an answer first
18foundation · easy
A company wants to reduce customer login friction by implementing single sign-on (SSO) to improve user experience. Which type of requirement is this?
Select an answer first
19application · medium
After configuring a new WAF policy to block SQL injection, a security analyst wants to ensure that the policy is not causing false positives that block legitimate traffic. Which approach would best validate this?
Select an answer first
20foundation · easy
A financial services company must implement a security control because its external auditor identified a gap against PCI DSS requirements. Which type of requirement is driving this control implementation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “401” is a trademark of its owner, used for identification only.

2.02 Determine the Correct Control to Address a Compliance or Business Requirement 401 Practice Questions (Page 4)

Questions 16–20

A company wants to prevent their web application from being attacked by common web exploits such as cross-site scripting and SQL injection. They have no specific compliance requirement, but they want to improve their security posture. Which F5 control should they implement?

A company wants to reduce customer login friction by implementing single sign-on (SSO) to improve user experience. Which type of requirement is this?

After configuring a new WAF policy to block SQL injection, a security analyst wants to ensure that the policy is not causing false positives that block legitimate traffic. Which approach would best validate this?

A financial services company must implement a security control because its external auditor identified a gap against PCI DSS requirements. Which type of requirement is driving this control implementation?

Keep studying — ARCHITECT SOLUTIONS