401 Security Solutions (401 - Security Solution Expert) Practice Questions
Prepare for 401 with more than an answer.
- Exam fee
- $180 USD
- Level
- Expert (F5 Certified Solution Expert)
- Valid for
- Certifications are valid for 2 years (F5 standard recertification cycle)
Domains covered on the exam 4
- THREAT ANALYSIS12%
- ARCHITECT SOLUTIONS29%
- OPERATION AND IMPLEMENTATION41%
- SECURITY RESPONSE18%
- 1
An organization is facing two distinct, simultaneous threats against their primary web application:
- A massive volumetric UDP flood targeting the application's public IP address.
- A sophisticated, low-and-slow credential stuffing attack utilizing distributed botnets attempting to log into user accounts.
Which TWO F5 solutions should the architect select to mitigate these specific threats effectively? (Select TWO)
Show answer details
Correct answer: B, C
BIG-IP AFM (Advanced Firewall Manager) is specifically designed to handle high-capacity network-layer (L3/L4) DDoS attacks, such as UDP floods, using hardware acceleration where available to drop the malicious traffic before it impacts the system.
Advanced WAF (or F5 Distributed Cloud Bot Defense) provides sophisticated bot mitigation capabilities, including behavioral analysis and credential stuffing protection, which are required to stop low-and-slow automated login attempts.
- 2
A government agency requires all outbound internet traffic originating from internal user workstations to be inspected by three distinct inline security devices: an Intrusion Prevention System (IPS), a Data Loss Prevention (DLP) solution, and a malware sandbox. Currently, much of this traffic is TLS 1.3 encrypted, rendering the inspection tools blind. A junior engineer proposes using a standard BIG-IP LTM virtual server with client and server SSL profiles to terminate the traffic, send it to a load balancing pool containing the security devices, and re-encrypt it.
As the lead architect, how do you justify recommending F5 SSL Orchestrator (SSLO) over the proposed standard LTM solution?
Show answer details
Correct answer: B
While BIG-IP LTM can terminate and re-encrypt SSL, it is fundamentally a load balancer designed to send traffic to one node in a pool. The requirement is to pass traffic through an IPS, then a DLP, then a sandbox (service chaining). SSL Orchestrator is specifically designed to manage these complex, multi-hop inspection service chains dynamically based on policy, which is extremely difficult and inefficient to replicate with standard LTM.
- 3
A university wants to implement granular access controls for its internal student portal. The requirements state that access must be granted based on the user's Active Directory group membership, the health status of their endpoint device (e.g., antivirus running), and must support Single Sign-On (SSO) to backend applications. Which F5 module provides the correct architecture to meet these requirements?
Show answer details
Correct answer: C
BIG-IP Access Policy Manager (APM) is the identity and access management module. It natively integrates with Active Directory for authentication/authorization, performs endpoint posture checks (EPSEC) to verify device health, and provides comprehensive Single Sign-On (SSO) capabilities. AFM and ASM do not perform user identity or endpoint posture checks.
- 4
When an enterprise scales its security infrastructure to dozens of BIG-IP Advanced WAF instances, managing individual policies via local web interfaces becomes an operational bottleneck. To solve this, the architect mandates the use of a specific F5 product for centralized policy deployment and analytics.
The required product is: _____
Show answer details
Correct answer: C
BIG-IQ Centralized Management is F5's platform for managing policies, licenses, and visibility across multiple BIG-IP devices from a single interface, eliminating the bottleneck of managing standalone appliances.
- 5
A security analyst is reviewing external threat intelligence feeds provided by F5 Labs. The research indicates a massive, ongoing campaign utilizing a newly discovered remote code execution (RCE) vulnerability in a popular open-source web framework. The organization relies heavily on this framework for its primary customer portal, but cannot apply the vendor patch for another 30 days due to change freeze constraints. Based on the threat research, what is the MOST immediate potential impact to the organization, and which action should be prioritized?
Show answer details
Correct answer: B
The threat intelligence specifies a Layer 7 (web framework) RCE vulnerability, which directly threatens the application layer with system compromise and data exfiltration. The most effective immediate mitigation, given the inability to patch the backend servers, is to deploy or update BIG-IP ASM/Advanced WAF with the latest attack signatures to virtually patch the vulnerability at the perimeter.
- 6
During a threat modeling exercise using the STRIDE methodology, an architect identifies that a legacy, monolithic application is highly susceptible to tampering and information disclosure. The application processes sensitive financial payloads but lacks robust input validation. However, the network architecture is well-segmented and the risk of infrastructure-level denial of service is determined to be negligible. Which risk profile correctly categorizes this environment, and what is the optimal F5 mitigation strategy?
Show answer details
Correct answer: C
The threat modeling data specifically highlights tampering and information disclosure at the payload level (Layer 7), while explicitly noting that infrastructure DoS risk is negligible. This indicates a Low Infrastructure / High Application risk profile. A positive security model in BIG-IP ASM, combined with strict schema/payload validation, directly mitigates the risk of tampering and enforces the missing input validation for the legacy application.
