Application Security
Application Security
The Application Security domain tests BIG-IP ASM: how a security policy is attached to a virtual server, how requests are inspected, and how learning, staging, and enforcement interact. Expect questions on attack signatures, parameters, cookies, XML/JSON profiles, bot defense, and logging.
Core rules
- ASM sits behind LTM. The virtual server must decrypt SSL and have an HTTP profile; the security policy is attached to the virtual server.
- A security policy uses Transparent or Blocking enforcement. Staging lets signatures and entities be learned without blocking until they are enforced; Transparent only reports.
- Entities include URLs, parameters, cookies, headers, and file types. Parameter level (global, URL, flow) determines where a violation applies.
- Attack signatures match patterns in requests; signature sets are updated independently of the policy. A signature can be staged, alarm, or block.
- XML and JSON profiles validate structure and schema; without the correct profile, content may be treated as plain text.
- Brute-force and DoS protections use login pages, IP intelligence, and rate limits, not just signatures.
Worked example
A request containing a quote-based SQL-injection payload reaches a virtual server with an ASM policy in Transparent mode. ASM records a SQL-injection signature violation and an alarm, but does not block. The administrator reviews the learning suggestions, confirms the parameter is a real query parameter, and moves the policy to Blocking with the signature enforced. A later request with the same payload gets a blocking response page, and the event is logged with the signature ID and request details.
Traps
- Assuming Transparent mode blocks attacks; it only reports and learns.
- Enforcing a policy before staging has learned legitimate application behavior, causing false positives.
- Forgetting that XML or JSON content needs the matching profile to be parsed.
- Confusing parameter-level violations with signature violations.
- Overlooking that bot defense and DoS settings are separate from signature enforcement.