When would you need to use a Layer 4 ACL in BIG-IP APM instead of a Layer 7 ACL?

Question

Options

• AWhen filtering traffic based on source IP addresses only
• BWhen enforcing access policies based on user roles and groups
• CWhen inspecting application data and URL patterns
• DWhen configuring IP Intelligence for GeoIP-based access controls

• A
  87% (33)
• B
  3% (1)
• C
  8% (3)
• D
  3% (1)

Explanation

Option A is correct because Layer 4 ACLs operate at the transport layer and make filtering decisions based solely on network-level attributes - source/destination IP addresses, ports, and protocols - without inspecting application content. When your requirement is simply "allow or deny this IP address," a Layer 4 ACL is the correct and more efficient tool.

B is wrong because enforcing access based on user roles and groups requires Layer 7 ACL, which can inspect identity context from the APM session (authenticated user, group membership, etc.) - information that doesn't exist at Layer 4.

C is wrong because URL pattern matching and application data inspection are definitively Layer 7 operations; they require deep packet inspection at the HTTP/application layer, which Layer 4 cannot perform.

D is wrong because IP Intelligence and GeoIP controls in BIG-IP are handled through dedicated IP Intelligence policies, not as the distinguishing reason to choose Layer 4 over Layer 7 ACL - and GeoIP lookups are typically configured at a policy level above basic ACL selection.

Memory tip: Use the phrase "Layer 4 sees numbers, Layer 7 knows names." If your filter only needs an IP address (a number), use Layer 4. If it needs a username, URL, or role (named identity/content), use Layer 7.

No community discussion yet for this question.