Which of the following statements are incorrect regarding protection of web services? (Choose 2)

Web services (SOAP/REST) communicate statelessly and do not rely on HTTP cookies, so ASM does not check or enforce cookie usage as part of its web service protection - this statement is technically incorrect.

BIG-IP ASM parses XML in inbound requests for web service protection; it does not perform XML parsing on XML responses as part of its core web services security enforcement, making this statement incorrect.

ASM does verify that XML documents are well-formed as part of its XML validation features, making this a correct statement and therefore not one of the incorrect ones.

ASM uses attack signatures to apply negative security logic against known web service attack patterns such as SQL injection inside XML payloads, which is a correct statement.

ASM performs XML syntax checking, XML schema validation against imported XSD files, and WSDL validation, all of which are correct capabilities and not incorrect statements.