3.07 Verify a Configuration Is Functioning as Intended to Mitigate a Vulnerability 401 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which log entry would indicate that a security configuration is functioning as intended?

   • AA system event indicating a scheduled reboot
   • BAn alert showing that a malicious request was blocked by the WAF policy
   • CA log entry showing a successful user login
   • DA log entry showing a configuration backup was completed
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization configured an ASM policy to block cross-site scripting (XSS) attacks. After deployment, the security team wants to verify the policy is actually blocking XSS payloads in production. They plan to send a test payload from an external source. Which approach provides the most reliable verification?

   • ASend a benign request and a known XSS payload from an external IP, then check the ASM violation logs for the XSS signature and the request's blocking action.
   • BReview the ASM policy configuration to confirm the XSS signature set is enabled and the blocking mode is set to 'blocking'.
   • CCheck the ASM learning suggestions to see if the XSS signature was recently added to the policy.
   • DUse tcpdump on the BIG-IP to capture the test payload and confirm the packet arrives at the virtual server.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which approach is used to verify that a security configuration is functioning as intended on a BIG-IP?

   • AReviewing the hardware specifications of the BIG-IP device
   • BChecking the version of the BIG-IP software
   • CComparing the running configuration to the saved configuration
   • DReviewing the organizational chart of the security team
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which test would confirm that an access control list (ACL) is functioning correctly?

   • AChecking the ACL's last modification date
   • BSending traffic that should be allowed and traffic that should be denied
   • CReviewing the ACL configuration in the text editor
   • DComparing the ACL to a template from the vendor
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team deployed an ASM policy to mitigate a specific vulnerability. The policy is in blocking mode. The team reviews the ASM logs and finds no violations for the vulnerability's signature over the past week. The vulnerability is known to be actively exploited in the wild. Which conclusion is the most defensible?

   • AThe absence of violations does not prove the mitigation is effective; it may mean no attack traffic has been observed, or the traffic is bypassing the WAF.
   • BThe ASM policy is not working because it should log violations for any attempt to exploit the vulnerability.
   • CThe mitigation is effective because no violations were logged, indicating the vulnerability is not being exploited.
   • DThe vulnerability is not being exploited because the ASM policy is blocking all attempts silently.
   Reveal Solution Discussion Select an answer first