3.07 Verify a Configuration Is Functioning as Intended to Mitigate a Vulnerability 401 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company deployed a new WAF policy to mitigate a recently disclosed vulnerability in a web application. The security team needs to confirm the mitigation is effective. They have access to the BIG-IP logs, ASM logs, and the vendor's CVE advisory. Which combination of actions provides the strongest evidence that the vulnerability is mitigated?

   • ACheck the BIG-IP system logs for any error messages related to the ASM policy after deployment.
   • BReview the ASM policy to confirm the relevant signature is enabled and the policy is assigned to the virtual server.
   • CSend a proof-of-concept exploit from the CVE advisory, confirm the ASM log shows a violation and blocking action, and verify the request did not reach the backend.
   • DCompare the ASM policy's signature set version to the vendor's recommended minimum version.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A government agency requires that all web traffic be inspected by a WAF. The security team configured an ASM policy and needs to verify it is functioning as intended to meet this policy. Which verification method provides the most comprehensive evidence?

   • ACheck the BIG-IP system logs for any ASM-related errors after the policy was deployed.
   • BVerify the ASM policy is in 'transparent' mode to ensure it is not blocking legitimate traffic.
   • CReview the ASM policy's signature set to confirm it includes the OWASP Top 10 signatures.
   • DConfirm the ASM policy is assigned to the virtual server, is in blocking mode, and send a test attack to verify the blocking action in logs.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which tool or method is commonly used to check a BIG-IP configuration against a security baseline?

   • ARunning a configuration compliance scan using a policy template
   • BChecking the number of active virtual servers
   • CExamining the hardware serial number
   • DReviewing the system's uptime
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An administrator configured an iRule to block requests with a specific User-Agent header. The iRule is attached to the virtual server. The administrator sends a test request with the blocked User-Agent and the connection is reset. However, the administrator is concerned the iRule may not be the cause of the reset. Which additional verification provides the strongest evidence that the iRule is responsible?

   • AReview the iRule code to confirm the User-Agent match and the drop command are correct.
   • BSend the same test request multiple times to confirm the reset is consistent.
   • CTemporarily disable the iRule, send the same test request, and confirm the connection is not reset.
   • DCheck the BIG-IP logs for any other security policies or rules that might also reset the connection.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security engineer configured an iRule on a virtual server to block HTTP requests containing a specific SQL injection pattern. After deploying, the engineer sends a test request with the pattern and observes the connection is reset. The engineer then sends a benign request and it passes through normally. Which additional step best confirms the mitigation is functioning as intended without disrupting production traffic?

   • ACheck the virtual server's statistics page to see if the total request count increased after the test.
   • BReview the BIG-IP logs to confirm the iRule logged the blocked request and verify the log entry contains the expected signature match.
   • CDisable the virtual server and rerun the same test to confirm the iRule is the only component causing the reset.
   • DSend the same malicious request 100 times to verify the iRule consistently resets the connection every time.
   Reveal Solution Discussion Select an answer first