F5-401 Security Expert flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Positive security model

An enforcement approach that permits only explicitly allowed methods, paths, parameters, and lengths, rejecting everything else. It is stricter than signature-based negative models and depends on accurate API discovery.

BOLA

Broken object level authorization: an API flaw where a client can access another user's object by changing an identifier. Defense requires server-side ownership checks, not client-supplied IDs.

Shadow API endpoint

An undocumented or forgotten API endpoint that is reachable but absent from the declared specification. It bypasses intended controls and is a primary target for attackers.

GraphQL query depth limit

A control that caps nested query depth to prevent resource-exhaustion attacks. It is paired with complexity and alias limits and query allowlisting for full protection.

Security policy attachment

On BIG-IP, a web application security policy takes effect only when attached to the virtual server and deployed. Traffic reaching the pool by another path is unprotected.

Transparent enforcement mode

A WAF mode that logs violations without blocking. It is used for baselining and tuning before switching the policy to blocking enforcement.

Signature accuracy level

A classification of attack signatures as low, medium, or high accuracy. Enabling low-accuracy signatures catches more attacks but raises false positives.

Learning suggestion

A WAF-generated recommendation to add a URL, parameter, or entity to the allowlist based on observed traffic. It must be reviewed before acceptance to avoid widening access.

Bot defense challenge

A client-side test such as JavaScript execution or CAPTCHA presented to suspicious clients. Legitimate browsers pass; automated tools typically fail and are blocked.

Layer 7 DDoS mitigation

Protection against application-layer floods using request-rate thresholds, partial-request detection, and behavioral analysis, distinct from volumetric L3/L4 defenses.

Device ID

A persistent identifier issued to a client by bot defense, allowing tracking across IP address changes. Native mobile apps require SDK integration for attestation.

Zero trust

A security model that grants no implicit trust based on network location. Every request is authenticated and authorized using identity, device posture, and context.

Device posture check

An evaluation of endpoint health signals such as patch level, disk encryption, and EDR presence. Failing posture can trigger remediation, step-up, or denial.

ZTNA connector

An outbound-only component that connects protected applications to the access service without exposing inbound ports. Applications stay invisible to unauthenticated users.

Microsegmentation

East-west workload policy enforcement using identity-based rules instead of IP-based trust. It limits lateral movement inside the data center after a compromise.

Continuous verification

Re-evaluating an active session when risk signals change, such as a new geography or token anomaly, rather than trusting a one-time login.

TLS 1.3 forward secrecy

TLS 1.3 mandates ephemeral (EC)DHE key exchange, so compromise of a long-term key does not decrypt past sessions. Static RSA key exchange is removed.

SNI-based profile selection

BIG-IP chooses the client SSL profile by the hostname in the TLS SNI extension. A default profile handles clients that send no SNI.

ML-KEM

The NIST post-quantum key-encapsulation standard (FIPS 203), derived from CRYSTALS-Kyber. It is deployed in hybrid mode with classical ECDHE during transition.

Harvest-now-decrypt-later

An attack where encrypted traffic is recorded today and decrypted by a future quantum computer. It motivates migrating key exchange to post-quantum hybrids early.

Cipher string order

In a TLS cipher configuration, the client and server negotiate the first mutually supported cipher in preference order. ECDHE with AEAD should rank first.

OCSP stapling

The server attaches a signed certificate revocation response to the handshake, reducing client lookup latency. Must-staple settings make the response mandatory.

AI Gateway

A control point between clients and LLM providers that centralizes authentication, provider routing, token quotas, logging, and cost control for AI traffic.

AI guardrails

Inspection rules applied to prompts and completions to detect PII, secrets, toxicity, and prompt injection. Violations can be redacted, blocked, or logged.

Prompt injection

An attack where untrusted content in a prompt steers the model to ignore instructions or leak data. Defenses include input filtering, instruction hierarchy, and output validation.

Shadow AI

Unsanctioned use of AI applications by employees outside approved channels. Workforce AI security discovers such use and routes sanctioned traffic through the gateway.

RAG source allowlist

A restriction limiting retrieval-augmented generation to approved document sources. Retrieved content is untrusted input and must be sanitized before entering the prompt.

Token budget

A per-team or per-key cap on model tokens enforced by the AI Gateway. It prevents cost abuse and limits data exfiltration through unapproved models.

Config sync

A BIG-IP device-group operation that pushes configuration from the sync owner to peers. Verify sync status after changes so all devices enforce the same policy.

Policy staging

Running a WAF policy in a non-blocking state to observe violations before enforcement. It does not block traffic until blocking is explicitly enabled.

Violation name

The specific WAF rule triggered by a request, such as signature, illegal method, or length violation. It identifies the cause of a block during troubleshooting.

Security logging profile

A BIG-IP profile that directs security events to local storage, remote syslog, or analytics. Without an attached logging profile, events are not recorded.