F5 BIG-IP APM Specialist (304) Certification Sample Questions

02. An organization has bought additional access capacity for a BIG-IP APM deployment that runs on a high availability pair, and the purchased entitlement now has to be brought onto the platform. Staff use the service throughout the working day.
Which two statements should shape the plan for this change?
(Choose two.)
a) One re-activation covers the pair, because the units present a single licensed identity inside their traffic group.
b) Both units have to be re-activated, because entitlement is held by the individual device rather than by the pair.
c) The standby is re-activated first and the roles are then swapped, because a unit reloads its configuration during the change.
d) Only the unit carrying traffic needs the newer entitlement, because the standby holds no access sessions of its own.
e) The unit carrying traffic can be re-activated in place, because the module keeps running and its sessions are undisturbed.

03. Endpoint inspection on a deployment needs to recognize a category of security software it currently cannot, and the maintenance window does not allow a system software upgrade. How is the inspection capability brought up to date?
a) The connectivity profile is reconfigured, replacing the components that the BIG-IP Edge Client installed previously.
b) Each endpoint is updated by its own management tooling, since the system only reads the result reported to it.
c) The access policy is re-published, which pushes refreshed inspection components to each client at the next logon.
d) An EPSEC update is installed on the BIG-IP, and clients refresh their components when they next connect.

04. A new security standard shortens the access policy timeout on a busy access profile. The inactivity timeout and the maximum session timeout are left as they were. Which two outcomes follow?
(Choose two.)
a) A user who pauses partway through the logon to fetch a code from a token device has to begin the logon again.
b) Sessions open at the moment the change is applied end there, since the profile's timers are re-evaluated when it is saved.
c) Users working continuously are asked to authenticate again sooner, since the shortened period is measured from logon.
d) Users at a Webtop lose their sessions after shorter periods away from the keyboard than they did before the change.
e) Sessions that have already been established are untouched, since the shortened period stops applying once the policy ends.

05. Two groups of staff share one office network and therefore one range of source addresses. Each group is to be allowed a different set of browsing destinations. Which control makes that distinction possible?
a) An IP Intelligence check on the outbound requests, which decides on the reputation of the address being contacted.
b) A GeoIP branch on the outbound requests, which decides on the country in which the destination site is hosted.
c) Secure Web Gateway with the users identified by the access policy, which decides on the group the requester belongs to.
d) An access control list applied to the outbound traffic, which permits or denies each request by its source and destination addresses.

06. Corporate branding — a logo, a footer and a restyled logon form — is applied to the pages an access policy presents. What does this customization change?
a) The presentation of every access policy on the system, because branding is stored independently of any one access profile
b) The wording and appearance presented to the user, while the credentials collected and the AAA object that validates them are unchanged
c) The credentials the policy collects, so the AAA object it uses must be re-pointed to match the fields the branded form presents
d) The appearance of the Webtop alone; the logon form takes its presentation from the connectivity profile rather than from the customization

07. While troubleshooting a branch that never matches, an engineer wants to see what a session actually holds in the variable the directory query populates, and plans to place a message box in the flow to display it.
Which two statements about this technique are accurate?
(Choose two.)
a) The message box must sit after the object that populates the variable, or it displays the empty value the branch is already reading.
b) The message box evaluates the variable and concludes the branch when the value is found to be empty.
c) The message box repopulates the variable from the directory, so that the following branch rule can read it.
d) The value is shown in the user's own browser, so the object has to be removed before the policy carries production traffic.
e) The message box records the variable's value for later inspection without interrupting the session's progress.

08. One access profile is applied to the virtual servers of four applications, each looked after by a different team. One team now wants an extra check in front of its own application. The other three want their logon left as it is, and their sessions unaffected by work the first team does.
What meets those requirements?
a) Apply a second access profile to that application's virtual server, so the check runs after the shared policy has finished.
b) Give that application an access profile of its own with the extra check added to that copy of the policy.
c) Add the check to the shared access policy and let each of the other three virtual servers disable it.
d) Add the check to the shared access policy, on a branch taken only when that application is requested, and leave the other three untouched.

09. A public self-service portal is fronted by a single access profile. Security wants to blunt automated credential abuse by capping the active sessions allowed from one IP address. Two large partner organizations use the same portal, and each partner's staff reach it through a single shared egress address.
Which two actions preserve the value of the control without denying the partners?
(Choose two.)
a) Raise the access profile's concurrent-user tuning to match the per-address ceiling, so the two settings agree and no partner is turned away
b) Apply the active-session limit on the virtual server instead of the access profile, so partner addresses are exempted from the profile's own limit
c) Publish the partner traffic through a separate virtual server with its own access profile, so the per-address ceiling can be tuned separately for them
d) Set the per-address ceiling high enough to cover the largest partner's expected simultaneous users, accepting a weaker constraint on that address
e) Set the profile scope to global so sessions from a shared address are counted once for the profile rather than once per address

10. Which statement describes what an attacker gains by capturing the session cookie that BIG-IP APM issued to a user of a published application?
a) The resources that session had already been granted, and only for as long as that session still exists on the system.
b) The user's directory credentials, which the attacker can then present to other systems that trust the same directory.
c) Nothing at all, because the cookie is replaced on every request and an earlier value is refused.
d) Continuing access to the application, because the cookie remains valid until the browser that stored it discards it.