Security, Access, and Application Delivery Controls
Security modules and enforcement points
This domain tests where BIG-IP enforces security and access, and how those controls interact with traffic processing. ASM (Advanced WAF) inspects HTTP requests and responses. APM provides access policies, authentication, and authorization. AFM provides network firewall and DoS controls. SSL Orchestrator steers TLS traffic to inspection devices. IP Intelligence supplies reputation data. Enforcement can also live in local traffic policies, iRules, HTTP security profiles, and virtual-server connection limits.
Access and management
An APM access policy is attached through an access profile on the virtual server; creating the policy alone does nothing. AAA, SAML, OAuth, MFA, and per-session ACLs control who reaches an application. Management access should be restricted by allowed addresses, HTTPS/SSH only, strong authentication, and role-based user accounts. Do not expose the management interface to the same network as application traffic without a control.
Application delivery controls
Connection and rate limits on virtual servers and pool members protect back ends. SYN cookie defends against SYN floods. Secure cookie and header controls belong in the HTTP security profile or an iRule. Compression and caching improve delivery but can leak data if applied to authenticated responses without care.
Worked example
A user submits a search containing an apostrophe and receives a block page. The ASM request log shows a SQL-injection signature matched a query parameter. The policy is in blocking mode, so the request is dropped. The correct first step is not to disable the signature globally: review the request, confirm it is legitimate, then add a targeted exception or tune the parameter, preferably after reproducing in staging or transparent mode. Switching the whole policy to transparent hides the problem and leaves the application exposed.
Traps
Enabling a WAF policy in blocking mode without a learning or staging period. Assuming ASM inspects non-HTTP protocols. Attaching an access profile but forgetting the corresponding virtual-server settings. Using a broad iRule header drop that breaks legitimate clients. Leaving management access open to any source.