F5-401 Security Expert study plan

Map the OWASP API Security Top 10 categories to concrete BIG-IP and Distributed Cloud controls, writing a one-line mitigation note for each of the ten categories.

Diagram a reference three-tier web and API architecture showing where WAF, API gateway, and load balancing decisions occur, and annotate each inspection point with the request/response data it can see.

Explain the difference between negative-security (signature) and positive-security (schema/allowlist) API enforcement models, and state which OpenAPI-derived constraints each model requires.

List the authentication and authorization flows (OAuth 2.0 grant types, OIDC, mTLS, JWT validation) and identify at which hop in your diagram each is enforced.

Configure an OpenAPI specification import workflow end to end in a lab, then record which schema violations (missing required fields, type mismatches, unexpected parameters) are blocked versus logged.

Build a positive-security policy that enforces parameter types, lengths, and allowed values on at least three endpoints, and verify each constraint with crafted requests.

Compare WAF enforcement modes (transparent, blocking, and per-request learning) and document the operational consequence of each for a production cutover.

Design a staged rollout plan that moves a new WAF policy from learning to blocking without breaking legitimate traffic.

Tune signature-based WAF protections against a realistic false-positive scenario, documenting each modification and its justification.

Configure bot defense signals (device fingerprinting, behavioral analysis, and challenge actions) and define which traffic classes receive challenge versus block.

Explain how volumetric, protocol, and application-layer DDoS attacks differ, and identify the mitigation layer and detection signal for each.

Draft rate-limiting and API abuse thresholds for a login endpoint and a read-heavy API, justifying each number against expected traffic patterns.

Contrast zero trust access models (identity-aware proxy, per-app microsegmentation, and continuous verification) and select the appropriate pattern for three given scenarios.

Configure an identity provider integration with a zero trust access policy, then test allow, deny, and step-up authentication paths.

Explain how mTLS and device posture signals feed access decisions, and identify the failure mode when posture data is stale.

Describe how zero trust principles change the design of a traditional DMZ-based network segmentation.

Trace a full TLS handshake and identify where certificate selection, SNI routing, and client authentication occur in a TLS-orchestrating proxy.

Design a certificate lifecycle process covering issuance, automated renewal, revocation, and expiry alerting, and state the failure impact of each step.

Explain the post-quantum threat model (harvest-now-decrypt-later) and distinguish hybrid key exchange from post-quantum certificate signatures.

Identify which TLS versions, cipher suites, and key-exchange groups a hybrid post-quantum deployment requires, and list the client-compatibility risks.

Map the AI traffic path (user prompt, gateway inspection, model provider, response) and identify which security controls belong at each hop.

Define guardrail policies for prompt injection, sensitive data leakage, and unsafe output, and specify the action (block, redact, log) for each category.

Explain how workforce AI security governs sanctioned versus unsanctioned AI application use, including discovery, policy enforcement, and data-loss prevention.

Describe how to log AI interactions for audit while respecting privacy constraints, and identify what must never be captured.

Build a deployment checklist covering configuration sync, high availability failover, and policy versioning for a BIG-IP security services rollout.

Practice diagnosing three failure classes from logs and telemetry alone: policy misconfiguration, backend health failure, and TLS handshake rejection.

Write runbook entries for common operational events (certificate expiry, WAF false-positive surge, DDoS activation) with detection, triage, and remediation steps.

Define the metrics and alerts that indicate a security control is degrading silently rather than failing loudly.

Rehearse the weakest two domains using timed practice scenarios, then re-teach each missed concept in writing from memory.

Synthesize a single end-to-end design that applies WAF, API security, zero trust, TLS orchestration, and AI guardrails to one hypothetical enterprise.

Review every deliverable from weeks 1 through 7 and close the documented residual gaps or explicitly accept them with rationale.

Build a one-page recall sheet of the facts, thresholds, and decision rules you most often got wrong.