101 · Question #178
When building a policy based on live traffic using the automated policy builder, which of the following elements will not be taken into account when analyzing the traffic?
The correct answer is A. The size of the response. The ASM automated policy builder examines URIs, response codes, and parameter values to model legitimate traffic, but HTTP response size is not a factor used in policy construction.
Question
When building a policy based on live traffic using the automated policy builder, which of the following elements will not be taken into account when analyzing the traffic?
Options
- AThe size of the response
- BThe requested resource (URI)
- CThe response code from the web server
- DThe parameter values of static based parameters
How the community answered
(57 responses)- A84% (48)
- B5% (3)
- C2% (1)
- D9% (5)
Why each option
The ASM automated policy builder examines URIs, response codes, and parameter values to model legitimate traffic, but HTTP response size is not a factor used in policy construction.
Response size is not one of the traffic attributes analyzed by the automated policy builder when learning normal application behavior. The builder focuses on structural and semantic elements of requests and responses - such as URLs, parameters, and status codes - rather than the byte length of response payloads.
The requested URI is a core element the policy builder analyzes to populate the allowed URL list and identify the application's attack surface.
Response codes from the web server help the policy builder determine which requests result in successful responses, filtering out error traffic from the learning set.
Static parameter values are evaluated by the policy builder to define allowed value patterns and establish a baseline for detecting anomalous or malicious input.
Concept tested: ASM automated policy builder traffic analysis criteria
Source: https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-asm-implementations/automatically-building-a-security-policy.html
Topics
Community Discussion
No community discussion yet for this question.