BIG-IP APM Specialist (304)

Part of F5 Certified Technology Specialist, BIG-IP APM

Targets: Product version not specified in the blueprint
Format: 80 questions (70 items that are scored, 10 pilot/beta items)
Time limit: 90 minutes
Pass mark: 245 (scaled range 100-350)
Exam fee: US$180 per attempt (not including local taxes and fees)
Blueprint source: Exam blueprint 304.92018 (official PDF, relayed by PRIME 2026-07-21). Catalog Key Info (fetched 2026-07-21): US$180, English, test-center proctored, passing score 245, 90 minutes, Technology Specialist level; prerequisite: valid F5-CA, BIG-IP certification ↗

Computer-based, multiple-choice; delivered at Pearson VUE test centers (English). Credential awarded: F5 Certified Technology Specialist, APM. Prerequisite: F5 Certified BIG-IP Administrator (F5-CA); the catalog lists the BIG-IP APM Specialist certification as a prerequisite for the Security Solutions Expert track.

Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by F5. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat F5's own certification portal as the source of truth and verify against it before you book anything.

Section 1: AUTHENTICATION, AUTHORIZATION, AND ACCOUNTING (AAA), SINGLE SIGN-ON (SSO), FEDERATED AUTHORIZATION, MOBILE DEVICE MANAGEMENT (MDM)

1.01 Explain how to configure different types of AAA methods
What to know:
- Configure AAA objects
- Microsoft Active Directory, LDAP, Radius, RSA SecurID, TACACS, (Kerberos/NTLM, Client Cert auth), end-point management system profile
On this site: LDAP Fundamentals: The Directory Model Behind Identity Systems, Kerberos and SPNEGO: How Silent Desktop SSO Actually Works
1.02 Demonstrate knowledge of the network requirements for each authentication service type
What to know:
- Demonstrate ability to test and validate connectivity to each authentication service (adtest output, ldapsearch output)
On this site: LDAP Fundamentals: The Directory Model Behind Identity Systems
1.03 Explain how to configure SSO objects
What to know:
- Determine specific SSO object requirements (e.g. Kerberos SPN requirements)
- Determine when to choose one type of SSO over another
On this site: APM SSO Methods: One Bad Object Can Dim the Whole Session, Kerberos and SPNEGO: How Silent Desktop SSO Actually Works
Tools: f5-apm-sso-explainer
1.04 Explain how to configure SAML as an SP and/or IdP
What to know:
- Integrate BIG-IP APM Service Provider (SP) with external vendor IdP (e.g. PING, Okta, SaaS, etc.) Configure Single Logout (SLO)
On this site: F5 BIG-IP APM as a SAML Proxy: SP and IdP Modes, SAML 2.0: How Browser SSO Works, SAML Bindings and SP vs IdP Initiation, Inside a SAML Assertion: Subject, Conditions, and Audience
Tools: saml-decoder

Section 2: NETWORK AND APPLICATION ACCESS

2.01 Explain how to configure SSL VPN manually or using a wizard
What to know:
- Determine which option is appropriate to use: Network access, Portal access, Web Application access (APM/LTM Mode)
- Choose appropriate Webtop type: Full, Network Access, Portal Access
On this site: VPN Fundamentals: What Tunnels Protect, and What They Don't
2.02 Explain how to configure Network Access Profiles
What to know:
- Configure profile settings (e.g. Connectivity profile options, Edge Client Options and updates, SNAT)
- Configure App Optimization
On this site: VPN Fundamentals: What Tunnels Protect, and What They Don't, SNAT and the Return-Traffic Problem
2.03 Explain how to configure portal access
What to know:
- Determine the appropriate level of patching
- Evaluate global ACL order
- Configure Resource Items
2.04 Explain how to configure application access
What to know:
- Configure Remote Desktop access (e.g. Launching applications, Custom Parameters)
- Deploy Citrix Bundle
- Configure App Tunnels
2.05 Explain how to configure Web Access Management (LTM-APM Mode)
What to know:
- Configure pool and virtual server
- Determine when to use Web Access Management
On this site: BIG-IP Pools and Load-Balancing Methods, BIG-IP Virtual Server Types, and What Each One Actually Does

Section 3: VISUAL POLICY EDITOR

3.01 Explain how to configure authentication and logon objects in VPE
What to know:
- Configure an auth and/or query object (e.g. Determine group membership, Configure required attributes)
- Add appropriate logon page type
On this site: Session Variables: Where APM Keeps Everything It Learned
Tools: f5-apm-session-variable-reference
3.02 Explain how to configure resource/custom variables
What to know:
- Set up SSO credential mapping
- Assign Webtops dynamically
- Configure variable assignment
On this site: Session Variables: Where APM Keeps Everything It Learned, APM SSO Methods: One Bad Object Can Dim the Whole Session
Tools: f5-apm-session-variable-reference
3.03 Explain how to configure VPE flow with multiple branches and objects
What to know:
- Determine policy ending types (allow, deny, redirect)
- Use a message box to display a variable in a VPE
- Assign custom session variables
On this site: Session Variables: Where APM Keeps Everything It Learned
Tools: f5-apm-session-variable-reference
3.04 Explain how to configure and apply macros
What to know:
- Use a macro to combine multiple VPE objects
- Demonstrate an understanding of differences in creating a macro versus an access policy

Section 4: DEPLOY AND MAINTAIN iAPPS

4.01 Determine when to use an iApp
What to know:
- Import and deploy supported iApp templates
- Determine the min/max BIG-IP module versions supported by a specific iApp template
- Determine which BIG-IP modules are required to deploy a specific iApp template
On this site: Deploying Applications with Templates: iApps and FAST
4.02 Apply procedural concepts to maintain iApps
What to know:
- Reconfigure a deployed iApp to update objects
- Identify iApp used to deploy an object
On this site: Deploying Applications with Templates: iApps and FAST
4.03 Determine appropriate applications for enabling/disabling strict updates
What to know:
- Make manual changes to a deployed application service
- Demonstrate an understanding of the impact of disabling strict updates
On this site: Deploying Applications with Templates: iApps and FAST

Section 5: ADMINISTRATING AND TROUBLESHOOTING BIG-IP APM

5.01 Apply procedural concepts to manage and maintain access profiles
What to know:
- Determine proper use of profile scope (e.g. profile, virtual server, global)
- Tune policy settings (e.g. multiple concurrent users, limit active sessions per IP address)
On this site: Session Variables: Where APM Keeps Everything It Learned
5.02 Perform basic customizations of the U/I
What to know:
- Apply corporate branding (i.e. adding a logo, footer, logon form)
- Add additional languages for browser localization
5.03 Demonstrate an understanding of how High Availability applies to BIG-IP APM (with respect to end users, policy sync, device fail-over)
What to know:
- Demonstrate an understanding of the limitation of two units per HA pair and traffic group
- Configure Access Policy Sync (e.g. Configuring local objects vs global, validate access policy sync)
On this site: BIG-IP High Availability: Device Trust, Device Groups, and Traffic Groups, Failover on BIG-IP: States, Forcing, and Network Failover, Config Sync on BIG-IP: When to Sync, and Why It Fails
5.04 Explain provisioning/licensing for BIG-IP APM
What to know:
- Update an existing license for BIG-IP APM
- Consider CCU utilization for different types of access policy deployments
On this site: Anatomy of a BIG-IP License File, Recovering a BIG-IP That Won't Load Its Config After an Upgrade
Tools: f5-bigip-license-explainer
5.05 Apply procedural concepts to gather relevant data
What to know:
- Gather data from relevant BIG-IP tools (e.g. session reports, session variables, tcpdump, ssldump, sessiondump, APM log)
- Add debug logic to APM iRules
- Configure Debug logging
On this site: Session Variables: Where APM Keeps Everything It Learned, BIG-IP tcpdump: How It Differs from Standard tcpdump, Capturing Safely on a Production BIG-IP, The BIG-IP Log Files: a Map of /var/log
Tools: f5-bigip-tcpdump-builder, packet-capture-plan-builder
5.06 Determine root cause
What to know:
- Compare expected vs actual behaviors based on problem description
- Analyze and correlate all collected data (client/BIG-IP/serverside) to understand where a failure occurred
- Determine cause of EPSEC failures
Tools: fault-hypothesis-builder, incident-timeline-rca-builder

Section 6: SECURITY

6.01 Explain how BIG-IP APM mitigates common attack vectors and methodologies
What to know:
- Demonstrate an understanding of how the BIG-IP solution mitigates common security risks (e.g., cookiehijacking, DoS attacks)
- Determine which features of the BIG-IP device mitigate common DoS attacks
- Deploy GeoIP and IP intelligence in the VPE to protect resources
On this site: SYN Flood Protection on BIG-IP: Cookies, Thresholds, and Who Answers First
Tools: f5-dos-vector-explainer
6.02 Determine which BIG-IP APM features should be used to mitigate a specific authentication attack
What to know:
- Configure logging
- Configure objects needed to deploy MFA
- Configure SNMP traps
On this site: Custom Alerting on BIG-IP: SNMP Traps, Email, and Remote Syslog
Tools: totp-hotp
6.03 Apply procedural concepts to manage user sessions
What to know:
- Identify user session details
- Demonstrate an understanding of BIG-IP APM session cookies
On this site: Session Variables: Where APM Keeps Everything It Learned
Tools: f5-apm-session-variable-reference
6.04 Identify use cases of Secure Web Gateway (SWG)
What to know:
- Compare transparent vs explicit proxy deployments
- Determine the purpose of SWG
On this site: HTTP Proxies: Forward vs Reverse, Explicit vs Transparent, SSL Forward Proxy: How Outbound TLS Interception Works and What Breaks It, How a PAC File Chooses a Proxy
Tools: netskope-steering-decision-explainer, pac-file-explainer
6.05 Describe access policy timeouts as related to security
What to know:
- Describe the differences between inactivity timeout, access policy timeout, and maximum session timeout
6.06 Explain how to configure and manage ACLs
What to know:
- Explain how ACLs are deployed by default when creating a policy
- Explain when a layer 4 or layer 7 ACL would be needed
6.07 Demonstrate an understanding of network security requirements for application access
What to know:
- Demonstrate an understanding of TCP/UDP ports required for application services
6.08 Apply procedural concepts to implement EPSEC
What to know:
- Configure client-side checks (e.g. anti-virus, firewall, registry)
- Update and install EPSEC software

Public sources, used in good faith

These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →