304 BIG-IP APM Specialist Practice Questions
Prepare for 304 with more than an answer.
- 1
When configuring a Virtual Server to provide Network Access (VPN) using BIG-IP APM, which two profiles are absolutely mandatory for the solution to function?
Show answer details
Correct answer: B
To deploy Network Access (SSL VPN) or App Tunnels, the Virtual Server must have both an Access Profile (which contains the authentication and policy logic) and a Connectivity Profile (which manages the underlying tunnel setup and client settings) applied.
- 2
An administrator is publishing an internal web application via LTM+APM. The virtual server listens on port 443, and the backend pool members listen on port 80. The APM policy displays a custom logon page. Which SSL profile configuration is required on the Virtual Server?
Show answer details
Correct answer: B
Because the virtual server listens on port 443 (HTTPS), it must terminate the client's SSL connection to present the APM logon page and inspect the traffic. Therefore, a ClientSSL profile is required. Since the backend pool members listen on port 80 (HTTP), the BIG-IP will send traffic unencrypted to the backend, meaning a ServerSSL profile is NOT required.
- 3
Users connected via APM Network Access (VPN) are reporting that they can establish a control connection to an internal Active FTP server, but data transfers fail because the FTP server cannot establish the return data channel back to the client. The Network Access lease pool is in the 10.10.10.0/24 subnet, and the FTP server is at 192.168.1.50 without a route back to the lease pool. How should the administrator resolve this issue on the BIG-IP?
Show answer details
Correct answer: C
In Active FTP, the server initiates the data connection back to the client. If the server lacks a route to the client's VPN IP (the lease pool), the connection fails. Enabling SNAT in the Network Access configuration translates the client's lease pool IP to a BIG-IP self IP. The FTP server then routes the return traffic to the BIG-IP, which translates it back to the client, solving the routing issue.
flowchart LR Client([VPN Client 10.10.10.5]) -->|Tunnel| APM[BIG-IP APM Self IP: 192.168.1.1] APM -->|SNAT Automap| FTP[FTP Server 192.168.1.50] FTP -.->|Return Data| APM APM -.->|Translated| Client - 4
When configuring AAA profiles in BIG-IP APM, which authentication type strictly requires the BIG-IP to join the domain and maintain a machine account object in the directory?
Show answer details
Correct answer: B
To perform native Active Directory authentication (using the AD Auth agent), the BIG-IP system must be joined to the Active Directory domain, which creates a machine account (computer object) for the BIG-IP within the AD environment. LDAP authentication, by contrast, only requires a bind account and does not require a domain join.
- 5
A financial organization is deploying a new web application through BIG-IP APM and requires stringent protection against cookie hijacking. The security team mandates that session cookies must not be accessible via client-side scripts and must only be transmitted over encrypted channels. Which combination of APM cookie settings will fulfill these requirements?
Show answer details
Correct answer: B
To mitigate cookie hijacking, the 'HttpOnly' attribute prevents client-side scripts (like JavaScript) from accessing the session cookie, mitigating Cross-Site Scripting (XSS) risks. The 'Secure' attribute ensures the browser only transmits the cookie over HTTPS connections, protecting it from being intercepted in plain text over unencrypted networks.
- 6
An e-commerce company is experiencing a brute-force credential stuffing attack targeting their APM-protected customer portal. The attackers are using a highly distributed botnet, making traditional IP blocking ineffective. Which BIG-IP APM feature or integration should the security architect deploy to most effectively mitigate this specific attack methodology?
Show answer details
Correct answer: C
IP Intelligence (IPI) dynamically feeds known malicious IP addresses (such as botnets, scanners, and spam sources) into the BIG-IP. By placing an IP Intelligence check early in the VPE flow, APM can instantly reject connections from these distributed botnet IPs before they ever reach the authentication prompt, effectively mitigating distributed brute-force attacks.
