101 · Question #248
Learning suggestions in the Policy Building pages allow for which of the following? (Choose 2)
The correct answer is C. Flow level parameters are displayed when found and can be accepted into the current policy. E. Maximum acceptable values for length violations are calculated and can be accepted into the. F5 BIG-IP ASM learning suggestions assist policy building by surfacing discovered flow-level parameters and by calculating suggested maximum length values that administrators can selectively accept into the active policy.
Question
Learning suggestions in the Policy Building pages allow for which of the following? (Choose 2)
Options
- AXMLbased parameters and associated schema are automatically learned.
- BBlocking response pages can be automatically generated from web site content.
- CFlow level parameters are displayed when found and can be accepted into the current policy.
- DThe administrator may modify whether the BIG-IP ASM System will learn, alarm, or block
- EMaximum acceptable values for length violations are calculated and can be accepted into the
How the community answered
(55 responses)- A9% (5)
- B16% (9)
- C71% (39)
- D4% (2)
Why each option
F5 BIG-IP ASM learning suggestions assist policy building by surfacing discovered flow-level parameters and by calculating suggested maximum length values that administrators can selectively accept into the active policy.
XML-based parameters and associated schemas are not automatically learned by the policy builder; XML profile configuration requires manual setup or explicit schema import.
Blocking response pages are preconfigured templates within ASM and cannot be automatically generated or derived from website content through the learning mechanism.
The ASM policy builder passively monitors traffic and identifies flow-level parameters such as form fields and query parameters that appear in requests, then presents them as learning suggestions on the Policy Building pages so administrators can review and selectively add them to the policy without manually defining each one.
Configuring whether ASM will learn, alarm, or block is a manual enforcement setting adjusted by the administrator directly in the policy, not a feature surfaced through the learning suggestions workflow.
When the ASM system observes parameter values that exceed defined length limits, it calculates a maximum acceptable length based on observed legitimate traffic and presents this value as a learning suggestion, allowing the administrator to accept the calculated maximum into the policy to reduce false positives.
Concept tested: F5 BIG-IP ASM policy builder learning suggestions workflow
Source: https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-asm-implementations/using-the-policy-builder-to-create-a-policy.html
Topics
Community Discussion
No community discussion yet for this question.