101 · Question #255
By default, BIG-IP ASM allows which of the following HTTP methods in a client request? (Choose 3)
The correct answer is B. GET C. POST D. HEAD. BIG-IP ASM permits GET, POST, and HEAD by default because these three methods cover standard web browsing and form submission without introducing significant upload or diagnostic attack surfaces.
Question
By default, BIG-IP ASM allows which of the following HTTP methods in a client request? (Choose 3)
Options
- APUT
- BGET
- CPOST
- DHEAD
- ETRACE
How the community answered
(59 responses)- A3% (2)
- B88% (52)
- E8% (5)
Why each option
BIG-IP ASM permits GET, POST, and HEAD by default because these three methods cover standard web browsing and form submission without introducing significant upload or diagnostic attack surfaces.
PUT is not allowed by default because it enables clients to upload or replace server-side resources, which poses a significant security risk if not explicitly required.
GET is required for retrieving web resources and is universally needed for normal browsing.
POST is required for submitting HTML forms and sending data to web applications, making it a standard default.
HEAD is allowed by default as it retrieves only response headers without a body, used for caching and link-checking with minimal risk.
TRACE is not allowed by default because it echoes the request back to the client and can be exploited in cross-site tracing (XST) attacks to steal credentials.
Concept tested: BIG-IP ASM default allowed HTTP methods
Source: https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-asm-implementations/setting-up-security-policy-manually.html
Topics
Community Discussion
No community discussion yet for this question.