Which of the following methods are used by the BIG-IP ASM System to protect against SQL injections?

HTTP RFC compliancy checks validate that requests conform to HTTP protocol standards; they do not inspect or restrict SQL-specific metacharacters in parameter values.

Metacharacter enforcement prevents SQL injection by blocking or escaping special characters such as single quotes, semicolons, and comment sequences that attackers embed in input to alter SQL query logic. Attack signatures provide a pattern-matching layer that detects known SQL injection payloads in request parameters, cookies, and headers, giving ASM two complementary and targeted defenses specifically designed for SQL injection.

Length restrictions limit input size and can reduce attack surface, but they do not detect or block SQL syntax patterns; combining them with RFC checks still leaves metacharacter-based SQL payloads unaddressed.

Response scrubbing is used to prevent sensitive data leakage in server responses and does not prevent SQL injection in inbound requests; including it here conflates two separate protection mechanisms.