F5 BIG-IP ASM Specialist (303) Certification Sample Questions

02. Expected violations are not appearing for an application, and the team must work through the possibilities systematically. Which two policy objects should be examined?
(Choose two.)
a) The logging profile on the virtual server, which decides whether events are recorded
b) The retention period configured for entries in the security event log
c) The certificate assigned to the virtual server that terminates the application's connections
d) The number of entities the policy holds for that application
e) The security policy assignment on the virtual server, or the mapping that selects the policy

03. Violations are appearing on dozens of unrelated parameters across an application, and in every case they name a character in the value that the application legitimately uses. Which mitigation is proportionate?
a) Disable meta character enforcement for the policy, so the check no longer applies anywhere
b) Adjust the character set the policy applies by default to parameters, so the application-wide convention is reflected once
c) Adjust the character set on each parameter the log has named so far
d) Place every parameter into staging until the application team has confirmed its character use and the traffic that exercises it

04. An auditor asks how user roles are used on a device hosting application security ASM policies. Which two statements are accurate?
(Choose two.)
a) Roles determine which logging profile, destination and format apply to the virtual servers a user reaches
b) A role determines which violations the policies it can reach will enforce on traffic
c) Roles specific to application security exist so that policy work can be granted without device administration
d) A role determines what a user may do, independently of which policy is in front of them
e) Roles are configured inside each security policy, so a policy carries its own list of users

05. Performance graphs show processing load climbing steadily from the moment a large additional signature set was enforced on a busy policy. What is the appropriate remediation?
a) Narrow the enforced sets to those matching the application's technology stack
b) Enable guaranteed logging so the additional matches are recorded completely
c) Switch the policy to transparent mode so violations no longer interrupt requests
d) Set the additional signatures to alarm only so their matches are recorded without blocking

06. Users report slowness. The most recent change was a signature update applied a week earlier, but the performance graphs show the degradation beginning three days after that. How should the engineer treat the change?
a) As unverifiable, since performance graphs cannot be correlated with configuration changes
b) As a candidate that the timing does not support, since other changes in that window should be examined first
c) As irrelevant, since a change applied a week earlier cannot affect performance later
d) As the confirmed cause, since a signature update is the change most likely to add per-request work to each request that is inspected

07. A security team must show that its reporting supports the organization's security objectives rather than merely producing numbers. Which two uses of report trends demonstrate that?
(Choose two.)
a) Establishing which administrator responded to each violation, and how quickly, over the period
b) Showing whether a change made in an earlier quarter reduced the violations it was intended to reduce
c) Confirming that every policy on the device holds the same number of entities
d) Directing tuning effort to the categories and applications where violations are growing
e) Demonstrating that the reporting period contains more entries than the previous one

08. Guaranteed logging was enabled during an investigation three weeks ago and has been left on. The application is now under seasonal peak load. What should the team consider?
a) Turning it off, since the investigation's findings are invalidated once peak load begins
b) Leaving it on, since disabling it would stop security events from being recorded at all
c) Turning it off, since the completeness it buys is no longer worth its cost at peak
d) Leaving it on, since the policy's enforcement depends on every request being recorded

09. Reviewing the log after an incident, an engineer finds entries showing that requests carrying a known attack pattern were recorded but reached the application. Which two conditions could produce this?
(Choose two.)
a) The policy had no attack signature sets attached, so the pattern was never matched
b) The matching signature was in staging, so its matches were logged without being enforced
c) The logging profile was detached from the virtual server, so enforcement was suspended
d) The enforcement readiness period had elapsed, so the entities involved left staging
e) The policy was in transparent mode, so no violation was acted on

10. Access-pattern data shows that one parameter has carried only three distinct values across six months of production traffic, and the application team confirms those are the only values its interface can produce. Which adjustment does the data support?
a) Remove that parameter from the policy, so its values are no longer evaluated at all
b) Raise that parameter's maximum value length, so none of the three values can be rejected
c) Convert that parameter to a wildcard, so the three values and any successors are covered
d) Constrain that parameter to the values observed, so anything else raises a violation