101 · Question #369
ASM can detect Layer 7 DoS attacks by which four ways of monitoring: (Choose four.)
The correct answer is A. Monitoring for a threshold of increased number of transactions per second per URL. B. Monitoring for a % change in transactions per second per URL. C. Monitoring for a % change in server latency or TPS. D. Monitoring for a threshold of increased server latency or TPS. F5 ASM detects Layer 7 DoS attacks by tracking both absolute thresholds and relative percentage changes in transactions per second and server latency, providing four distinct detection vectors.
Question
ASM can detect Layer 7 DoS attacks by which four ways of monitoring: (Choose four.)
Options
- AMonitoring for a threshold of increased number of transactions per second per URL.
- BMonitoring for a % change in transactions per second per URL.
- CMonitoring for a % change in server latency or TPS.
- DMonitoring for a threshold of increased server latency or TPS.
- EMonitoring ASM policy builder performance.
- FMonitoring BIG-IP CPU utilization.
- GDeep Packet inspection.
How the community answered
(31 responses)- A81% (25)
- E3% (1)
- F10% (3)
- G6% (2)
Why each option
F5 ASM detects Layer 7 DoS attacks by tracking both absolute thresholds and relative percentage changes in transactions per second and server latency, providing four distinct detection vectors.
ASM can trigger a DoS alert when the raw number of transactions per second for a specific URL crosses a configured threshold, identifying abnormal request surges.
ASM also detects attacks by measuring the percentage change in TPS per URL relative to a baseline, catching gradual ramp-up attacks that may stay below absolute thresholds.
Monitoring the percentage change in server latency or overall TPS allows ASM to identify degradation caused by application-layer floods even when raw numbers appear moderate.
A hard threshold on server latency or TPS lets ASM flag sudden spikes that exceed an operator-defined ceiling, complementing the percentage-based method.
ASM Policy Builder monitors traffic to build security policies automatically, not to detect real-time DoS conditions.
BIG-IP CPU utilization is a system health metric, not a Layer 7 application-level DoS detection mechanism within ASM.
Deep Packet Inspection is a general network technique not used by ASM as one of its four defined Layer 7 DoS detection methods.
Concept tested: F5 ASM Layer 7 DoS detection methods
Source: https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-asm-implementations/detecting-and-preventing-dos-attacks.html
Topics
Community Discussion
No community discussion yet for this question.