F5-401 Security Expert key terms

A WAF approach that permits only traffic matching explicitly defined allowed behavior and blocks everything else, so unknown inputs are denied by default rather than judged against a list of known bad patterns.

A WAF approach that blocks traffic matching known attack signatures while allowing everything else, which means protection depends on signatures being current and complete.

A deployment phase in which a WAF observes traffic and builds a baseline of legitimate application behavior, such as allowed parameters and lengths, before enforcement begins.

A pattern or rule that identifies a known exploit attempt in a request or response, such as SQL injection syntax or a path traversal sequence, and triggers a violation when matched.

A legitimate request that a security control incorrectly flags or blocks, typically because a rule is too broad or the application profile does not yet reflect real usage patterns.

The ongoing practice of adjusting security policy, such as disabling irrelevant signatures or adding exceptions, so protection stays effective without blocking valid traffic.

A recorded event showing that a request or response breached a configured security policy check, such as a disallowed file type, method, or parameter length.

The container that binds application profiles, attack signatures, learning settings, and enforcement actions together and determines how traffic to protected applications is evaluated.

A configuration object describing the expected structure of traffic for one application, including allowed URLs, parameters, methods, and entity types used by the security engine.

The process of identifying API endpoints actually in use by observing traffic or scanning specifications, so undocumented or shadow endpoints can be brought under protection.

An API endpoint that is live and reachable but absent from official documentation and inventory, making it a common target because it may lack authentication or monitoring.

A machine-readable document describing an API's paths, methods, parameters, and schemas, used by security tools to validate requests against declared structure.

Enforcing that request or response bodies conform to a declared data model, including required fields, types, and formats, which blocks malformed or unexpected payloads.

Techniques that classify automated traffic and apply differentiated actions, such as allowing known good crawlers, challenging suspicious clients, or blocking abusive automation.

Collecting client-side signals such as headers, canvas rendering, and behavior to distinguish real browsers from scripted clients that spoof user-agent strings.

A test that requires a human-solvable task before granting access, commonly used to slow automated abuse without permanently blocking a client.

An attack that floods a target with massive traffic volume, such as UDP or ICMP floods, intended to saturate bandwidth before any application-layer inspection occurs.

An application-layer attack that mimics legitimate requests, such as HTTP floods or slow POST requests, and is hard to stop with volume-based filtering alone.

Restricting how many requests a client may make in a time window, used to blunt brute force, scraping, and application-layer floods while preserving service for normal users.

A dedicated network location where attack traffic is diverted, filtered, and cleaned before legitimate traffic is forwarded to the origin.

Advertising the same IP address from many locations so traffic reaches the nearest point of presence, which spreads attack load and shortens paths to users.

A security model that grants no implicit trust based on network location and instead verifies identity, device posture, and context for every request to a resource.

A service that authenticates users and issues assertions about them, such as SAML or OIDC tokens, which access proxies consume to make authorization decisions.

A mechanism letting a user authenticate once with a central identity service and reach multiple applications without separate credentials, typically via federation protocols.

Requiring two or more independent proof types, such as a password plus a hardware token or push approval, before granting access to a protected resource.

Granting only the access needed for a specific task and no more, which limits blast radius when credentials are stolen or a user account is misused.

Dividing a network into fine-grained zones with explicit allow rules between workloads, so lateral movement after a compromise is constrained.

An assessment of a client device's health and configuration, such as patch level, disk encryption, or managed status, used as a condition for granting access.

Policy that grants or denies access based on context signals such as user identity, device posture, location, and risk score rather than on network position alone.

The point at which encrypted traffic is decrypted so it can be inspected or routed, after which it may be re-encrypted toward the backend.

Establishing a new encrypted session from the proxy to the backend server after terminating the client-side connection, preserving encryption on the internal leg.

A TLS handshake extension carrying the requested hostname in plaintext, letting a proxy choose the right certificate and policy before decryption completes.

The ordered set of certificates from the server certificate through intermediate authorities to a trusted root, which clients validate to confirm identity.

An entity trusted to sign certificates and vouch for the binding between a public key and an identity, forming the basis of TLS trust.

An automated protocol for proving control of a domain and obtaining or renewing certificates without manual steps, reducing expiry-related outages.

Tracking issuance, renewal, rotation, and revocation of certificates across many hosts so that none silently expire or remain trusted after compromise.

Having the server attach a signed, time-stamped revocation status for its own certificate during the handshake, avoiding a separate client lookup.

Cryptographic algorithms designed to resist attack by large-scale quantum computers, intended to replace key exchange and signatures vulnerable to future decryption.

Combining a classical and a post-quantum key agreement in one handshake so security holds if either method remains unbroken, easing migration risk.

Designing systems so algorithms, key sizes, and certificates can be swapped through configuration rather than redesign, which is essential for adopting post-quantum schemes.

An attack strategy of capturing encrypted traffic today in hopes of decrypting it once quantum computing matures, which motivates early migration to post-quantum key exchange.

A control point that brokers traffic between applications and AI model providers, applying authentication, logging, rate limits, and policy to model requests and responses.

An attack that hides instructions in content a model processes, causing it to ignore its intended task or leak data to an attacker.

Policy checks applied to model inputs and outputs that detect and block harmful content, sensitive data leakage, or disallowed topics before users see results.

Inspecting content in motion for sensitive data such as credentials or personal information and blocking or redacting it before it leaves the organization.

The external or internal service that hosts and serves an AI model, reached through a defined API whose credentials and usage an organization must govern.

A unit of text a language model processes, used to measure request size, cost, and rate limits in AI traffic management.

Controls governing employee use of AI tools, such as approved application lists, data handling rules, and visibility into which AI services receive corporate data.

Use of AI applications and models without organizational approval or oversight, creating unmonitored paths for sensitive data to leave the enterprise.

A Tcl-based script on BIG-IP that can inspect and modify traffic events, often used for custom security logic, redirects, or header manipulation.

A declarative rule set on BIG-IP that matches traffic conditions and takes actions such as redirect, forward, or select a pool, without writing scripting code.

A BIG-IP object representing a listening address and port plus the traffic policy that determines how matching connections are processed.

A group of backend servers that a virtual server can distribute traffic across, with health monitors determining which members receive connections.

A probe that periodically checks whether a pool member is responding correctly, removing failed members from service until they recover.

Providing a desired-state configuration document so a device or service configures itself to match, reducing manual steps and making deployments repeatable.

Two devices configured so one actively serves traffic while the other stands ready to take over, maintaining service if the active unit fails.

The process of shifting traffic and responsibilities from a failed component to a standby one, ideally with minimal disruption to active connections.