An operator has been informed by the application team that normal behavior of a new application will generate HTTP error code 403. The operator would like to avoid false positive in the significant…

Question

Options

• AWrite a Datascript for the HTTP Response event that matches on the HTTP 403 response code
• BCreate a new Analytics Profile which disables non-significant logs.
• CCreate a new Analytics Profile which contains HTTP 403 in the "Exclude HTTP Status codes from
• DCreate a new Analytics Profile which disables significant logs.

• A
  6% (2)
• B
  10% (3)
• C
  13% (4)
• D
  71% (22)

Explanation

Note: The stated correct answer (D) appears to be incorrect. Option C is the more accurate answer for this scenario and aligns with how analytics profiles work in platforms like F5 BIG-IP.

Why C is correct: When an application legitimately generates HTTP 403 responses, adding 403 to the "Exclude HTTP Status Codes from significant logs" list in an Analytics Profile prevents those expected responses from being flagged as significant events - directly solving the false positive problem without sacrificing overall visibility.

Why the other options are wrong:

• A - A DataScript can manipulate or respond to HTTP events, but it doesn't control what appears in significant logs within an Analytics Profile.
• B - Disabling non-significant logs is the opposite of what's needed; significant logs are where false positives are appearing.
• D - Disabling all significant logs eliminates the false positives, but also blinds the operator to every other genuinely significant event - a sledgehammer when a scalpel is needed.

Memory tip: Think "exclude the noise, keep the signal." The Analytics Profile's HTTP status code exclusion list lets you surgically remove known-good codes (like this team's expected 403) from significant log noise, while D is the destructive option that removes all significant logging entirely.

If your exam source lists D as correct, it may contain a typo or error - double-check against official vendor documentation.

No community discussion yet for this question.