nerdexam
F5

101 · Question #161

There is multiple HTTP class profiles assigned to a virtual server. Each profile has Application Security enabled. Which statement is true?

The correct answer is B. Traffic will process through the first HTTP class profile that it matches and then stops. When multiple HTTP class profiles with ASM enabled are assigned to a virtual server, BIG-IP uses a first-match model and stops evaluating after the first matching profile.

Section 2: F5 Solutions and Technology

Question

There is multiple HTTP class profiles assigned to a virtual server. Each profile has Application Security enabled. Which statement is true?

Options

  • ATraffic will process through every HTTP class profile every time.
  • BTraffic will process through the first HTTP class profile that it matches and then stops.
  • CTraffic will process through one HTTP class profile and if the traffic matches another profile, BIG-
  • DTraffic will only process through the HTTP class profile that it matches but always processes

How the community answered

(28 responses)
  • A
    4% (1)
  • B
    89% (25)
  • D
    7% (2)

Why each option

When multiple HTTP class profiles with ASM enabled are assigned to a virtual server, BIG-IP uses a first-match model and stops evaluating after the first matching profile.

ATraffic will process through every HTTP class profile every time.

Traffic does not process through every assigned HTTP class profile; BIG-IP halts evaluation at the first profile match.

BTraffic will process through the first HTTP class profile that it matches and then stops.Correct

BIG-IP ASM applies a first-match policy when evaluating HTTP class profiles on a virtual server. Once incoming traffic satisfies the conditions of the first matching profile, that profile's security policy is applied and no further profiles are evaluated. This ensures deterministic policy enforcement and avoids redundant or conflicting processing.

CTraffic will process through one HTTP class profile and if the traffic matches another profile, BIG-

BIG-IP does not continue evaluating additional profiles after a match is found; processing stops at the first match.

DTraffic will only process through the HTTP class profile that it matches but always processes

There is no mechanism that forces traffic to always process through a specific profile regardless of match order; only the first matched profile is applied.

Concept tested: HTTP class profile first-match processing in BIG-IP ASM

Source: https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-application-security-manager-implementations/applying-asm-to-an-http-class-profile.html

Topics

#HTTP class profiles#virtual server#Application Security#traffic processing order

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 101 Practice