Configure DDOS Vectors F5CAB1 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A social media company runs a public API on BIG-IP. Attackers are sending a high volume of HTTP requests to a specific endpoint, overwhelming the backend application servers. The administrator needs to configure a DDoS protection profile to mitigate this attack. Which DDoS vector should be enabled and tuned?

   • AHTTP Flood
   • BUDP Flood
   • CICMP Flood
   • DTCP SYN Flood
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An online payment company has a BIG-IP system protecting its transaction API. The security team wants to configure a DDoS protection profile that includes vectors for TCP SYN Flood, UDP Flood, and HTTP Flood. After creating the profile, what must the administrator do to ensure the vectors are active?

   • ACreate a separate profile for each vector and assign them all to the virtual server
   • BEnable the vectors globally in the BIG-IP system settings
   • CEnable the desired vectors within the profile and assign the profile to the virtual server
   • DConfigure the vectors directly on the virtual server without a profile
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A government agency runs a public records search service on BIG-IP. Attackers are sending a high volume of fragmented IP packets to the service, causing the BIG-IP system to spend excessive CPU resources reassembling them and dropping legitimate traffic. The administrator needs to configure a DDoS protection profile to mitigate this attack. Which DDoS vector should be enabled?

   • ATCP SYN Flood
   • BDNS Flood
   • CHTTP Flood
   • DIP Fragmentation Flood
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A network administrator observes a flood of TCP SYN packets sent to a server, each with a spoofed source IP address, causing the server's connection queue to fill. Which type of DDoS attack is this?

   • ASYN flood
   • BICMP flood
   • CHTTP slowloris
   • DDNS amplification
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A university runs a public research data portal on BIG-IP. The security team enabled the HTTP Flood vector with a low threshold to protect against application-layer attacks. During a legitimate research campaign, many users simultaneously download large datasets, causing the HTTP Flood vector to trigger and block legitimate traffic. The team must maintain protection against real HTTP floods while allowing the legitimate campaign traffic. What should the administrator do?

   • AMove the portal to a different virtual server without DDoS protection
   • BChange the HTTP Flood vector action to rate-limit instead of block
   • CDisable the HTTP Flood vector during the campaign
   • DRaise the HTTP Flood vector threshold to accommodate the legitimate campaign traffic peak
   Reveal Solution Discussion Select an answer first