F5 Security Solutions (401) Certification Sample Questions

01. A partner system sends traffic in bursts that resemble a flood, and network-layer DoS protection on a shared service address acts on it. The partner must never be mitigated, the same protection must stay in force for every other source, and the partner cannot be moved to a different service address.
Which approach fits those constraints?
a) Placing the partner on its own virtual server with protection settings suited to its bursts
b) Classifying the partner's traffic as permitted so that enforcement passes over it and continues for others
c) Raising the level at which protection engages so that the partner's bursts no longer reach it
d) Removing protection from the shared address and applying it at the upstream network edge instead

02. One obligation requires the same restriction on how requests are handled across four applications. Two are maintained by teams with release capacity this quarter; the other two are vendor-supplied and cannot be changed. An architect proposes implementing the restriction once on the delivery tier for all four, and each application team offers to implement it in its own code instead.
Which two statements justify the architect's proposal on the facts recorded?
(Choose two.)
a) Implementing at the tier means the application teams need no longer treat the restriction as a requirement for their own code.
b) The delivery tier evaluates a request before the application receives it, which costs less than a check performed in application code.
c) The vendors' support terms are unaffected by a change made outside their software, which settles the obligation for those two.
d) Two of the four cannot be changed at all, so an implementation in application code cannot meet the obligation across the set.
e) One implementation governs all four alike, so the obligation is met the same way everywhere rather than in four places that can drift apart.

03. Configuration changes made with a stolen administrator credential have been found across several managed BIG-IP devices. The credential's access has already been withdrawn and the management path is isolated. The services themselves are running and must stay up while the response moves to eradication.
Which action fits that stage?
a) Rotate the remaining administrator credentials and re-issue them under stronger authentication requirements.
b) Restore every affected device from its last known-good configuration and return it to the management group.
c) Identify each object the credential altered from the centralized record and revert those objects.
d) Compare the current traffic profile against the period before the changes and investigate any difference.

04. Three tools inspect outbound traffic at a site. Two of them can act only on cleartext, and the third works from connection metadata. The design must not decrypt and re-encrypt the same session more than once, and no payload may leave the inspection segment in the clear.
Which two requirements do those constraints place on the architecture?
(Choose two.)
a) The cleartext tools sit on the client side of the decryption point, where the payload is already available
b) Re-encryption happens where the decrypted segment ends, before the session is handed onward
c) The two cleartext tools sit inside a single decrypted segment fed by one decryption point
d) Each cleartext tool is given its own decryption point, so a fault in one does not stop the other
e) The third tool is moved into the decrypted segment so all three act on the same copy of the session

05. A governance rule states that the security team must review and approve every application security policy change before it reaches production, and that reviewers may not hold credentials on the production BIG-IP devices themselves. Which arrangement satisfies both parts of that rule?
a) A staging device that mirrors production, where reviewers examine the change before administrators re-create it by hand on the production units
b) Read-only administrative accounts for reviewers on each production device, with deployment left to the device administrators
c) A ticket queue in which the security team approves a written description of the change before an administrator applies it
d) A management tier where the change is staged, reviewed and deployed, with reviewers' rights held there and not on the devices

06. In an outbound inspection deployment, users reach most external sites normally but a small and stable set of destinations fails to load. The inspection devices record no session for the failing flows, and the same destinations load normally from a host whose traffic bypasses the deployment entirely.
Which cause does this pattern point to?
a) Re-encryption is placed before inspection in the chain, so those flows leave the chain without being decrypted.
b) Those destinations match a bypass rule, which is why no session is recorded, and the failure lies downstream.
c) The client applications reject the re-signed certificate for those destinations and abandon the connection.
d) The inspection devices are saturated and shedding new sessions, which affects a subset of destinations.

07. A sector body circulates a report on an actor currently active against organizations of this kind. The report records the addresses the actor has been seen using, the sequence of requests its tooling issues against a logon path, and the fact that the actor changes hosting between campaigns.
Which two uses of that report are sound?
(Choose two.)
a) Require every client on the logon path to complete an additional authentication step for as long as the campaign is described as active.
b) Enforce on the ordered pattern its tooling produces, since that is what survives a move to different infrastructure.
c) Deny the hosting providers' ranges named in the report, since the actor has used them and may return to them.
d) Treat the address list as evidence with a limited life, reviewing what is enforced from it rather than leaving it in place indefinitely.
e) Refuse clients presenting the identifier the actor's tooling supplies against the logon path, since the report records what that tooling sends.

08. Four regional sites each operate their own BIG-IP devices for a different set of applications. A review records two findings: investigations routinely need events from more than one site placed on a single timeline, and no two sites should be running the same policy, because no two serve the same applications.
What do those findings indicate the estate needs?
a) Collection and reporting of every site's security events in one place, with policy authority left where the applications are understood.
b) Each site's events forwarded to whichever site most often leads investigations, so that the timeline is assembled where the work is done.
c) A common policy baseline across the four sites, so that the events they produce can be compared with one another on a timeline.
d) Central management of policy as well as of reporting, since an estate that reports through one tier has to be configured through it as well.

09. An insurer wants fraud findings from its customer portal to reach the fraud-operations team that already investigates claims. It will not have transactions refused at the delivery tier, because a refused genuine claim costs it more than a reviewed fraudulent one. The insurer has also stated that findings must concern actions capable of moving money, because its fraud team will not triage findings raised on ordinary browsing.
Which two design choices meet those conditions?
(Choose two.)(b,d)
a) Suppress the sources that findings are raised against by their reputation category.
b) Deliver the fraud findings as alerts into the system the fraud team already works from.
c) Refuse the flagged submissions in the application security policy and log each refusal.
d) Instrument only the portal flows where a claim is submitted or a payee is changed.
e) Require a further authentication step from any session a finding has been raised against.

10. Network-layer denial-of-service protection has been configured for a published service in response to a specific attack vector observed against a peer organization. The service owner has approved a controlled test against the production service inside an agreed window.
Which activity would demonstrate that the configuration mitigates that vector as intended?
a) Direct traffic with the vector's characteristics at a laboratory copy of the device from an internal host.
b) Direct traffic with a different vector's characteristics at the protected service and confirm the protection acts on it.
c) Direct traffic with the vector's characteristics at the protected service and observe legitimate sessions continuing.
d) Review the peer organization's account of the attack against the vectors the profile is able to mitigate.