I85PREP
⌘ K
F5-CTP study materials
F5-CTP study resources

F5-CTP practice questions

One question at a time. Build your F5-CTP understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1F5 cloud architecture, declarations and operational control

Which AS3 (Application Services 3) declaration element holds virtual servers and pools?

  1. Tenant > Application Correct answer.
  2. Device > Profile
  3. Class > Monitor
  4. Domain > Pool

Explanation

The Tenant and Application hierarchy organizes relevant AS3 application-service declarations under its supported schema. It is not a guarantee that every object or feature is supported in every version or that a tenant label creates independent physical security isolation. Validate actual schema, compatibility and resulting configuration.

Question 2F5 cloud architecture, declarations and operational control

What authentication mechanism does iControl REST prefer for automation tokens?

  1. Basic auth in URL
  2. Token issued via /mgmt/shared/authn/login, sent in X-F5-Auth-Token header Correct answer.
  3. Kerberos only
  4. Plain text Cookie

Explanation

For automation, iControl REST supports short-lived tokens obtained by POSTing credentials to /mgmt/shared/authn/login. The token is included in X-F5-Auth-Token on subsequent calls. It has a configurable timeout and avoids sending credentials repeatedly.

Question 3F5 cloud architecture, declarations and operational control

What is F5 iApps LX and how does it relate to iControl LX?

  1. Both are the same - declarative extensions written in Node.js on the REST framework Correct answer.
  2. iApps LX is for DNS only
  3. iControl LX is hardware only
  4. iApps LX is deprecated by F5

Explanation

iControl LX (iApps LX) is the Node.js-based extension framework used to build declarative iControl REST endpoints like AS3, DO, and TS. Extensions run on the BIG-IP REST framework and expose new endpoints under /mgmt/shared/... or /mgmt/tm/...

Question 4F5 cloud architecture, declarations and operational control

Which automation tool streams BIG-IP telemetry (stats, events) to external analytics platforms?

  1. AS3
  2. Telemetry Streaming (TS) Correct answer.
  3. Declarative Onboarding (DO)
  4. iRules

Explanation

Telemetry Streaming is a declarative iControl LX extension. It reads BIG-IP stats and events and streams them to destinations like Splunk, DataDog, Azure Log Analytics, and AWS CloudWatch using JSON configurations.

Question 5F5 cloud architecture, declarations and operational control

Which iControl REST URI returns a list of all virtual servers in the Common partition?

  1. /mgmt/tm/ltm/virtual Correct answer.
  2. /mgmt/tm/sys/virtual
  3. /mgmt/shared/resolver
  4. /mgmt/tm/ltm/pool

Explanation

GET /mgmt/tm/ltm/virtual lists virtual servers. /mgmt/tm/ltm/pool lists pools, /mgmt/tm/ltm/node lists nodes, /mgmt/tm/ltm/monitor lists monitors. These follow the TMSH hierarchy.

Question 6F5 cloud architecture, declarations and operational control

Which iControl REST endpoint is used to upload a UCS backup file?

  1. POST /mgmt/shared/file-transfer/uploads/<filename> Correct answer.
  2. PUT /config/ucs
  3. POST /mgmt/tm/ucs
  4. GET /var/log

Explanation

File uploads via iControl REST use POST /mgmt/shared/file-transfer/uploads/<filename> with chunked transfer and Content-Range headers. Downloads use /mgmt/shared/file-transfer/downloads/<filename>. This is how automation tools push/retrieve UCS files.

Question 7F5 cloud architecture, declarations and operational control

Which AS3 class represents a pool monitor?

  1. Monitor Correct answer.
  2. Pool
  3. Service_HTTP
  4. Endpoint_Policy

Explanation

In AS3 declarations, the 'Monitor' class (or specific Monitor_HTTP, Monitor_TCP, etc.) declares a health monitor. Pools then reference Monitors by name. This follows the declarative pattern where each resource has its own class.

Question 8BIG-IP LTM listeners, persistence and TLS boundaries

Which LTM feature allows session stickiness based on a value stored in an iRule session table?

  1. Universal Persistence Correct answer.
  2. Source Address Affinity
  3. SSL Session ID
  4. Destination Address

Explanation

Universal persistence uses an arbitrary value (extracted by an iRule - often via the persist uie command) as the persistence key. This enables sticky sessions based on JSESSIONID, custom headers, API keys, or any application-level token.

Question 9BIG-IP LTM listeners, persistence and TLS boundaries

Which iRule command stores a universal persistence record?

  1. persist uie <key> Correct answer.
  2. HTTP::persist
  3. pool::persist
  4. session::add

Explanation

'persist uie <key> <timeout>' tells BIG-IP to add a universal persistence record using the supplied key. On subsequent requests, BIG-IP reuses the stored pool member selection. This enables stickiness on things like application session tokens.

Question 10BIG-IP LTM listeners, persistence and TLS boundaries

Which LTM advanced feature lets you selectively persist based on a parameter in the POST body?

  1. Universal persistence with iRule parsing POST Correct answer.
  2. Source Address Affinity
  3. ICMP monitor
  4. SNAT pool

Explanation

Universal persistence combined with an iRule that inspects POST body (after HTTP::collect) can persist based on a form parameter (e.g., sessionID in a login POST). This is the most flexible persistence type - any attribute can be the key.

Question 11BIG-IP application security, access and DNS decisions

In the supplied ASM/Advanced WAF policy-template model, which listed description best matches the intended minimal baseline starting approach of Rapid Deployment, rather than a guarantee about immediate complete protection?

  1. Blocks all traffic
  2. Creates a minimal policy that protects against common attacks with immediate deployment Correct answer.
  3. Permits unrestricted traffic
  4. Only monitors HTTP headers

Explanation

Rapid Deployment is intended as a minimal baseline starting policy approach in the stated template model. Its actual checks, enforcement, false positives and protection depend on configuration, version and application behavior. The name does not guarantee immediate complete protection, and controlled validation and refinement remain necessary.

Question 12BIG-IP application security, access and DNS decisions

Which ASM feature generates policy updates based on observed legitimate traffic?

  1. Policy Building via learning Correct answer.
  2. Manual override
  3. Static signature update
  4. DDoS profile

Explanation

Policy Building / Traffic Learning analyzes real traffic and suggests changes - adding parameters, URLs, file types, meta-characters - to the ASM policy. Suggestions can be accepted automatically (tight learning) or manually reviewed before enforcement.

Question 13BIG-IP application security, access and DNS decisions

What does ASM signature staging do?

  1. Immediately blocks matched traffic
  2. Lets new or updated signatures observe traffic without blocking until confirmed not causing false positives Correct answer.
  3. Disables signatures
  4. Logs only warnings

Explanation

Signature staging is a learning phase where new or updated signatures are in Alarm-only/learn-only mode. False positives generate learning suggestions rather than blocks. Only after verification are signatures moved into Enforced state.

Question 14BIG-IP application security, access and DNS decisions

Which ASM / Advanced WAF feature defends against automated bot traffic?

  1. Bot Defense / Proactive Bot Defense Correct answer.
  2. Sensitive Parameters
  3. XFF header rewrite
  4. OneConnect

Explanation

Bot Defense detects and mitigates automated traffic using bot signatures, anti-automation challenges (CAPTCHA, JavaScript challenges), and Proactive Bot Defense (PBD) which validates clients before allowing requests.

Question 15BIG-IP application security, access and DNS decisions

Which DoS profile feature on ASM detects L7 DoS by analyzing traffic deviation from baseline?

  1. Per-URL rate limit only
  2. TPS-based detection and behavioral (stress-based) detection Correct answer.
  3. Signature staging
  4. iRules

Explanation

The ASM/Advanced WAF DoS profile has two detection modes: TPS-based (alerts on transactions-per-second thresholds) and Behavioral/Stress-based (detects deviations from a learned baseline using machine learning). Behavioral mode can mitigate zero-day L7 DoS.

Question 16BIG-IP application security, access and DNS decisions

What is the ASM concept of 'positive security model'?

  1. Only block known bad traffic
  2. Only allow traffic matching known-good patterns (whitelist of URLs, parameters, file types) Correct answer.
  3. Log everything
  4. Disable signatures

Explanation

Positive security model allows only traffic matching explicitly-defined good patterns. ASM builds a positive model via learning (observed parameters, URLs, methods), then blocks anything outside that known-good set. Contrast with negative (signature-based) blocking.

Question 17BIG-IP application security, access and DNS decisions

Which ASM violation type catches SQL injection attempts?

  1. Attack Signatures Correct answer.
  2. Cookie Hijacking
  3. Content Length Violation
  4. Evasion Technique

Explanation

ASM Attack Signatures detect known exploit patterns including SQLi, XSS, command injection, and path traversal. Signatures are grouped (e.g., SQL Injection group) and updated via scheduled signature update subscription.

Question 18BIG-IP application security, access and DNS decisions

Which ASM feature masks sensitive values (like credit cards) in logs?

  1. Sensitive Parameters / Data Guard Correct answer.
  2. X-Forwarded-For
  3. OneConnect
  4. Persistence Mirroring

Explanation

Sensitive Parameters and Data Guard mask (or block) sensitive data in requests/responses (credit card numbers, SSNs, AD credentials). Data Guard scans responses for leakage while Sensitive Parameters prevent logging of request values.

Question 19BIG-IP application security, access and DNS decisions

Which ASM protection type addresses brute-force login attacks?

  1. Brute Force Protection via failed login detection Correct answer.
  2. HTTP::redirect
  3. OneConnect
  4. SNAT Automap

Explanation

ASM Brute Force Protection monitors login URLs for failed attempts and can enforce CAPTCHA, client-side challenges, or source IP blocking when thresholds are exceeded. Protection can be per-URL or per-IP.

Question 20BIG-IP application security, access and DNS decisions

Which ASM feature defends against session hijacking?

  1. Session Hijacking Protection (user tracking across session) Correct answer.
  2. Bot Defense
  3. DNS Cache
  4. FastL4 profile

Explanation

ASM Session Hijacking Protection tracks user identifiers (session cookies, device fingerprints) across requests. If mid-session, IP or fingerprint changes unexpectedly, ASM can block or challenge the request as potentially hijacked.

Question 21BIG-IP application security, access and DNS decisions

Which Advanced WAF feature validates API traffic against a schema?

  1. API Protection / OpenAPI/Swagger schema validation Correct answer.
  2. BIG-IQ License Pool
  3. vCMP
  4. Cookie Rewrite

Explanation

Advanced WAF (ASM) API Protection validates incoming API requests against an OpenAPI/Swagger 2.0/3.0 schema, enforcing paths, HTTP methods, parameter types, and required fields. This positive model blocks requests that don't conform to the API contract.

Question 22BIG-IP application security, access and DNS decisions

Which ASM feature detects evasion techniques like URL encoding tricks?

  1. Evasion Technique Detection within attack signatures Correct answer.
  2. OneConnect
  3. Cookie Rewrite
  4. Bot Defense

Explanation

ASM detects and normalizes evasion techniques - double encoding, URL path traversal, null byte injection - before applying attack signatures. This prevents attackers from bypassing signatures through character encoding tricks.

Question 23BIG-IP application security, access and DNS decisions

Which Advanced WAF feature specifically protects XML-based services?

  1. XML Profile with schema validation Correct answer.
  2. iRules
  3. FastL4
  4. SNAT

Explanation

Advanced WAF XML profiles parse XML requests and optionally validate against an XSD schema or WSDL. They protect XML-based services (SOAP APIs) from XXE, entity-expansion DoS, and schema-violation attacks.

Question 24BIG-IP application security, access and DNS decisions

Which F5 Advanced WAF feature protects credentials at form submission via encryption?

  1. DataSafe (formerly WebSafe) Correct answer.
  2. OneConnect
  3. Cookie Rewrite
  4. DNS Express

Explanation

DataSafe (formerly part of WebSafe) injects JavaScript that encrypts form fields (passwords, credit card numbers) at the client. Encrypted values flow through browser/keylogger/malware harmlessly; BIG-IP decrypts before sending to backend.

Question 25BIG-IP application security, access and DNS decisions

Which ASM enforcement mode allows violations to be observed but not blocked?

  1. Transparent mode Correct answer.
  2. Blocking mode
  3. Learning off
  4. FastL4

Explanation

In Transparent enforcement, ASM generates violation logs and learning suggestions without blocking traffic. Blocking mode enforces the policy by blocking violations. Transparent is used during policy tuning or monitoring-only deployments.

Question 26BIG-IP application security, access and DNS decisions

Which ASM feature addresses credential stuffing attacks?

  1. Credential Stuffing Protection (leaked credential check) Correct answer.
  2. Cookie Rewrite
  3. OneConnect
  4. DNS Express

Explanation

Credential Stuffing Protection in Advanced WAF integrates with F5 intelligence feeds that list leaked credentials. On login submissions, known-compromised username/password combos can trigger challenges, alerts, or blocking.

Question 27BIG-IP application security, access and DNS decisions

Which ASM policy element restricts which HTTP methods are allowed (GET, POST)?

  1. Allowed Methods Correct answer.
  2. Attack Signatures
  3. DoS profile
  4. Bot Defense

Explanation

Allowed Methods in ASM policy lists valid HTTP methods. Requests using methods not in the list (e.g., TRACE, OPTIONS on an app that doesn't need them) violate the policy and are blocked or logged depending on enforcement.

Question 28BIG-IP application security, access and DNS decisions

Which ASM / Advanced WAF feature profiles client behavior using machine learning to detect anomalies?

  1. Behavioral L7 DoS / Bot Detection ML Correct answer.
  2. Attack Signatures
  3. OneConnect
  4. DNS Express

Explanation

Behavioral L7 DoS and anti-bot ML in Advanced WAF analyze client request patterns, mouse movement, fingerprints, and server stress to build a baseline and detect behavioral anomalies that suggest automated or attack traffic, even for zero-day threats.

Question 29BIG-IP application security, access and DNS decisions

Which ASM capability automatically protects against Layer 7 DoS via machine learning?

  1. Behavioral L7 DoS profile with anomaly detection Correct answer.
  2. iRule rate limit
  3. DNS Firewall
  4. SNAT Automap

Explanation

Behavioral L7 DoS uses ML to build a baseline of normal traffic and detect anomalies indicative of DoS (stress-based detection, request rate deviations). It then applies mitigations like client challenges or rate limits automatically.

Question 30BIG-IP application security, access and DNS decisions

Which ASM feature protects from parameter tampering in GET query strings?

  1. Parameter enforcement (allowed parameters, types, value lengths) Correct answer.
  2. OneConnect
  3. FastL4
  4. iQuery

Explanation

ASM Parameter enforcement validates query and POST parameters against defined allowed parameters, data types (alphanumeric, integer, email, etc.), and length constraints. Requests with unknown or misformatted parameters can be blocked.

Question 31BIG-IP application security, access and DNS decisions

Which ASM feature logs request details for forensic investigation?

  1. Request Logging / Event Logging with remote HSL Correct answer.
  2. DNS Cache
  3. iQuery
  4. Cookie rewrite

Explanation

ASM Event Logging (local DB + remote HSL to SIEM) captures full request details for policy violations - URL, parameters, headers, attack signature matched, support ID - enabling forensic investigation and threat hunting.

Question 32BIG-IP application security, access and DNS decisions

How is an ASM security policy typically associated with a virtual server?

  1. LTM Policy with ASM condition routing matched traffic to the policy Correct answer.
  2. Via SNAT
  3. Via DNS Cache
  4. Via BIG-IQ only

Explanation

A Local Traffic Policy (LTM Policy) on the virtual server can enforce ASM policies based on matches (e.g., host or URI). Alternatively, the ASM policy can be directly assigned to the virtual server via the Security tab.

Question 33BIG-IP LTM listeners, persistence and TLS boundaries

Among these options, which supports a supplied custom LDAP bind/search health-check script when the design specifically requires an external monitor rather than a built-in LDAP template?

  1. HTTP monitor
  2. External (EAV) monitor with ldapsearch Correct answer.
  3. ICMP monitor
  4. FastL4 monitor

Explanation

An external monitor can run the specified custom bind/search check under a supported controlled script arrangement. Native LDAP monitors can be suitable where their features meet the requirement; an external script is not universally required or preferred. Protect bind credentials, constrain actions and verify the actual result.

Question 34BIG-IP LTM listeners, persistence and TLS boundaries

Which LTM monitor type probes using a custom payload and expects a specific response string?

  1. HTTP with Send and Receive strings Correct answer.
  2. ICMP
  3. TCP Half-Open
  4. FastL4

Explanation

HTTP monitors (and the generic External Content Verification - ECV monitors) allow configuring custom Send strings (e.g., GET /health HTTP/1.0\r\n\r\n) and Receive strings (e.g., OK) to validate application health beyond simple port probes.

Question 35BIG-IP LTM listeners, persistence and TLS boundaries

Which LTM monitor is appropriate for a SIP VoIP application?

  1. HTTP
  2. SIP monitor Correct answer.
  3. SSL
  4. UDP Half-Open

Explanation

The SIP monitor sends a SIP OPTIONS request (over UDP, TCP, or TLS) and expects a valid SIP response. Use it to health-check SIP application servers like IP PBXs and SBCs accurately.

Question 36BIG-IP LTM listeners, persistence and TLS boundaries

What is the difference between inband and out-of-band monitors?

  1. None
  2. Inband observes live traffic; out-of-band sends synthetic probes on a separate channel Correct answer.
  3. Inband is UDP only
  4. Out-of-band cannot use HTTP

Explanation

Inband monitors analyze real client-server traffic for failures. Out-of-band monitors send dedicated probe requests (e.g., HTTP GET) separate from user traffic. Using both provides faster failure detection plus coverage when there's no active traffic.

Question 37BIG-IP LTM listeners, persistence and TLS boundaries

Which listed LTM profile controls supported compression of outgoing HTTP responses in the supplied model?

  1. HTTP Compression profile Correct answer.
  2. Stream profile
  3. TCP profile
  4. SSL profile

Explanation

An HTTP Compression profile controls supported outgoing HTTP response compression in the stated configuration. Actual decompression, inspection and recompression require their separately supported features and settings. Attaching this profile alone does not prove every compressed response is inspected or every content type is transformed.

Question 38BIG-IP LTM listeners, persistence and TLS boundaries

Which LTM profile combines multiple HTTP requests onto one server-side connection?

  1. OneConnect Correct answer.
  2. Stream
  3. FastL4
  4. SSL

Explanation

OneConnect is the LTM connection pooling profile. It multiplexes requests from many client connections across a shared pool of server-side TCP connections, reducing backend resource use for short-lived HTTP sessions.

Question 39BIG-IP LTM listeners, persistence and TLS boundaries

Which LTM module feature provides TCP optimization between BIG-IP and clients over long-latency links?

  1. TCP profile with Nagle, Delayed Acks, and optimized congestion control algorithms Correct answer.
  2. ICMP monitor
  3. FastL4 forwarding
  4. DNS Express

Explanation

The TCP profile offers congestion control algorithm choice (e.g., BBR, CUBIC, HighSpeed), window scaling, selective acks, timestamps, and custom timeouts. Tuning it for high-latency or lossy client networks can significantly improve throughput.

Question 40BIG-IP TMOS operation, configuration and recovery evidence

Which F5 tool centralizes ASM policy management across many BIG-IPs?

  1. DevCentral
  2. BIG-IQ Correct answer.
  3. iRules
  4. iControl

Explanation

BIG-IQ Centralized Management is the relevant centralized-management product among these alternatives. Supported policy editing, deployment and visibility capabilities depend on the actual versions, managed modules and permissions. A central interface does not prove every object type or version is compatible or every pushed change succeeds.

Question 41BIG-IP TMOS operation, configuration and recovery evidence

What does 'BIG-IQ' stand for in F5 terminology?

  1. BIG Integration Query
  2. BIG-IQ Centralized Management - F5's management and analytics platform Correct answer.
  3. BIG Internal Queue
  4. BIG-IP QuickStart

Explanation

BIG-IQ Centralized Management is F5's centralized management and analytics platform for managing many BIG-IP devices, deploying AS3 declarations, handling license pools, visualizing traffic, and centrally managing ASM and APM policies.

Question 42BIG-IP LTM listeners, persistence and TLS boundaries

In the supplied standard HTTP virtual-server model terminating client TLS and re-encrypting a separate backend TLS leg, which listed profile arrangement matches the two encrypted legs?

  1. Client-SSL and Server-SSL both attached Correct answer.
  2. Only Client-SSL
  3. Only Server-SSL
  4. Stream profile

Explanation

The stated bridging model uses client-side and server-side SSL profiles for the respective TLS legs. Each leg has relevant trust, certificate and compatibility requirements. This does not imply that every other virtual-server model sends plaintext merely because a server SSL profile is absent; pass-through is a different arrangement.

Question 43BIG-IP LTM listeners, persistence and TLS boundaries

Which LTM object ties Client-SSL and Server-SSL together on a virtual server for SSL bridging?

  1. Both profiles attached at the virtual server Correct answer.
  2. OneConnect
  3. Stream profile
  4. Route Domain

Explanation

A Standard virtual server can have both a Client-SSL and a Server-SSL profile attached. Together they enable SSL bridging: decrypt client TLS, inspect/iRule/WAF, then re-encrypt to backend. This allows inspection with backend encryption preserved.

Question 44BIG-IP LTM listeners, persistence and TLS boundaries

Which F5 TLS feature inspects TLS without breaking it (metadata only)?

  1. TLS Inspection via passive metadata - SNI/JA3 fingerprint in iRule Correct answer.
  2. Client-SSL full termination
  3. ICMP
  4. FastL4

Explanation

Even without SSL termination, BIG-IP can inspect TLS metadata like SNI server_name or JA3/JA4 client fingerprints via iRules or FastL4 to classify traffic, apply routing, or block threats - useful where decryption isn't possible.

Question 45BIG-IP TMOS operation, configuration and recovery evidence

Which LTM command quickly shows active connections to a specific virtual server?

  1. tmsh show sys connection cs-server-addr <vip> Correct answer.
  2. tmsh list ltm virtual
  3. tmsh show ltm pool
  4. tmsh show net self

Explanation

'tmsh show sys connection cs-server-addr <vip>' filters the live connection table by the destination (client-side server) IP. This is invaluable for live troubleshooting, verifying traffic is reaching the VIP, and observing session state.

Question 46BIG-IP application security, access and DNS decisions

Which listed APM construct defines the authentication and authorization decision workflow in the supplied visual-policy model, evaluated by the platform using relevant inputs?

  1. Connectivity profile
  2. Access Policy (built via Visual Policy Editor - VPE) Correct answer.
  3. Pool
  4. Rewrite profile

Explanation

An Access Policy represents the relevant authentication/authorization workflow and branches in the supplied APM model. It is evaluated by the platform with supported inputs and actions, rather than merely executing as an arbitrary client-side program. Actual session and per-request policy roles require their configured context.

Question 47BIG-IP application security, access and DNS decisions

Which APM feature authenticates users against Active Directory for SSO to Windows web apps?

  1. SAML
  2. OAuth2
  3. Kerberos Constrained Delegation (KCD) Correct answer.
  4. RADIUS

Explanation

Kerberos Constrained Delegation (KCD) in APM allows BIG-IP to obtain a Kerberos ticket on behalf of the authenticated user to an Active-Directory-integrated backend (IIS, SharePoint). This provides seamless Windows SSO without exposing passwords.

Question 48BIG-IP application security, access and DNS decisions

Which APM function is used to federate with a cloud IdP like Entra ID or Okta?

  1. SAML 2.0 (APM as SP or IdP) Correct answer.
  2. LDAP bind only
  3. Cookie persistence
  4. Traffic Group

Explanation

APM supports SAML 2.0 both as a Service Provider (accepting assertions from IdPs like Entra ID, Okta, Ping) and as an Identity Provider (issuing assertions to SaaS apps). It also supports OAuth2/OIDC flows for modern API auth.

Question 49BIG-IP application security, access and DNS decisions

What does F5 Access (client) enable?

  1. Admin GUI
  2. Endpoint SSL VPN client for remote access via APM Correct answer.
  3. Bot protection
  4. DNS filtering

Explanation

F5 Access (formerly BIG-IP Edge Client) is the endpoint agent that establishes SSL VPN tunnels or per-app VPN connections to BIG-IP APM for remote-access users. It supports Windows, macOS, iOS, Android, and Linux.

Question 50BIG-IP application security, access and DNS decisions

What is a 'per-request policy' in APM used for?

  1. Only runs at login
  2. Evaluates each HTTP request (not just session start) for dynamic access control or rate limiting Correct answer.
  3. Controls DNS
  4. Handles SSL offload

Explanation

Per-request policies are evaluated on every HTTP request within an established session. They are used for Secure Web Gateway (SWG) category filtering, step-up authentication for sensitive URLs, or dynamic policy changes mid-session.