BIG-IP ASM Specialist (303)

Part of F5 Certified Technology Specialist, BIG-IP ASM

Targets: Product version not specified in the blueprint
Format: 80 questions (70 items that are scored, 10 pilot/beta items)
Time limit: 90 minutes
Pass mark: 245 (scaled range 100-350)
Exam fee: US$180 per attempt (not including local taxes and fees)
Blueprint source: Exam blueprint 303.72017 (official PDF, relayed by PRIME 2026-07-21). Catalog Key Info (fetched 2026-07-21): US$180, English, test-center proctored, passing score 245, 90 minutes, Technology Specialist level ↗

Computer-based, multiple-choice; delivered at Pearson VUE test centers (English). Credential awarded: F5 Certified Technology Specialist, BIG-IP ASM. Prerequisite: F5 Certified BIG-IP Administrator (F5-CA); the catalog lists F5-CTS, BIG-IP ASM as a prerequisite for the Security Solutions Expert track.

Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by F5. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat F5's own certification portal as the source of truth and verify against it before you book anything.

Section 1: ARCHITECTURE/DESIGN AND POLICY CREATION

1.01 Explain the potential effects of common attacks on web applications
What to know:
- Understand and describe how the ASM can affect clients and applications directly while in either transparent or blocking mode
- Summarize the OWASP Top Ten
On this site: Blocking vs Transparent: What Advanced WAF Enforcement Mode Really Does
1.02 Explain how specific security policies mitigate various web application attacks
What to know:
- Understand/interpret an iRule or LTM policy to map application traffic to an ASM policy
- Explain the trade-offs between security, manageability, false positives, and performance
On this site: Blocking vs Transparent: What Advanced WAF Enforcement Mode Really Does, Handling False Positives in Advanced WAF: Triage by Rating, Then Tune with Scope
Tools: f5-irules-vs-ltm-policy
1.03 Determine the appropriate policy features and granularity for a given set of requirements
What to know:
- Understand application (security) requirements and convert requirements to technical tasks
On this site: How a BIG-IP Advanced WAF Declarative Policy Is Structured
Tools: f5-awaf-declarative-policy-explainer
1.04 Determine which deployment method is most appropriate for a given set of requirements
What to know:
- Determine which deployment method is most appropriate given the circumstances (web services, vulnerability scanner, templates, rapid deployment model)
1.05 Explain the automatic policy builder lifecycle
What to know:
- Create any profiles required to support the policy deployment (xml, JSON, logging profiles)
- Implement anomaly detection appropriate to the web app (D/DoS protection, brute force attack, web scraping, proactive bot defense)
On this site: Automatic Learning in Production: How an Attacker Poisons a WAF Policy, L7 Behavioral DoS (BaDoS): How Advanced WAF Learns Normal and Mitigates the Rest, Client-Side Signals and Challenges: How Advanced WAF Tells a Browser from a Bot
Tools: f5-awaf-learning-suggestion-interpreter, f5-awaf-learning-poisoning-estimator
1.06 Review and evaluate policy settings based on information gathered from ASM (attack signatures, DataGuard, entities)
What to know:
- Configure initial policy building settings (automatic policy builder settings)
On this site: Data Guard: Masking Sensitive Data in Responses, Signature Staging and the Enforcement Readiness Period
Tools: f5-awaf-learning-suggestion-interpreter
1.07 Define appropriate policy structure for policy elements
What to know:
- Define appropriate policy structure for policy elements (URLs, parameters, file types, headers, sessions and logins, content profiles, CSRF protection, anomaly detection, DataGuard, proactive bot defense)
On this site: Advanced WAF Content Profiles: Parsing JSON, XML, GraphQL, and GWT Safely, Data Guard: Masking Sensitive Data in Responses, How a BIG-IP Advanced WAF Declarative Policy Is Structured, Advanced WAF Session Tracking: Finding and Stopping the Client Behind the Requests
Tools: f5-awaf-declarative-policy-explainer
1.08 Explain options and potential results within the deployment wizard
What to know:
- Describe options within the deployment wizard (deployment method, attack signatures, virtual server, learning method
- Select the appropriate ASM deployment model given the business requirements
1.09 Explain available logging options
What to know:
- Explain the specifications of the remote logger (ports, types of logs, formats, address)
On this site: The BIG-IP Log Files: a Map of /var/log
Tools: syslog-pri-decoder
1.10 Describe the management of the attack signature lifecycle and select the appropriate attack signatures or signature sets
What to know:
- Understand management of attack signature lifecycle (staging, enforcement readiness period) and select appropriate attack signatures or signature sets.
On this site: Signature Staging and the Enforcement Readiness Period
Tools: f5-awaf-signature-accuracy-risk

Section 2: POLICY MAINTENANCE AND OPTIMIZATION

2.01 Evaluate the implications of changes in the policy to the security and functionality of the application
What to know:
- Evaluate whether the rules are being implemented effectively and appropriately to meet security and/or compliance requirements and make changes as appropriate
On this site: Handling False Positives in Advanced WAF: Triage by Rating, Then Tune with Scope
Tools: f5-awaf-policy-diff
2.02 Explain the process to integrate natively supported third party vulnerability scan output and generic formats with ASM
What to know:
- Refine appropriate policy structure for policy elements (URLs, parameters, file types, headers, sessions and logins, content profiles, CSRF protection, anomaly protection)
- Explain how to manage policies using import, export, merge, and revert
On this site: How a BIG-IP Advanced WAF Declarative Policy Is Structured
Tools: f5-awaf-policy-diff
2.03 Evaluate whether rules are being implemented effectively and appropriately to mitigate violations
What to know:
- Evaluate the implications of changes in the policy to the security and vulnerabilities of the application
On this site: Handling False Positives in Advanced WAF: Triage by Rating, Then Tune with Scope
Tools: f5-awaf-request-log-triage
2.04 Determine how a policy should be adjusted based upon available data
What to know:
- Tune an ASM policy for better performance, including use of wildcards to improve efficiency
On this site: Handling False Positives in Advanced WAF: Triage by Rating, Then Tune with Scope
Tools: f5-awaf-false-positive-triage
2.05 Define the ASM policy management functions
What to know:
- Identify the status of the policy
- Define the violation types that exist in ASM
- Describe how to merge and differentiate between policies
Tools: f5-awaf-policy-diff

Section 3: REVIEW EVENT LOGS AND MITIGATE ATTACKS

3.01 Interpret log entries and identify opportunities to refine the policy
What to know:
- Examine traffic violations, determine if any attack traffic was permitted through the ASM and modify the policy to remove false positives
- Locate and interpret reported security violations by end users and application developers
On this site: Handling False Positives in Advanced WAF: Triage by Rating, Then Tune with Scope
Tools: f5-awaf-request-log-triage, f5-awaf-false-positive-triage
3.02 Given an ASM report, identify trends in support of security objectives
What to know:
- Understand and describe each major violation category and how ASM detects common exploits
- Generate reporting for the ASM system and review the contents of the reports (anomaly statistics, charts, requests, PCI compliance status)
On this site: AVR: Application Visibility and Reporting on BIG-IP
Tools: f5-awaf-request-log-triage
3.03 Determine the appropriate mitigation for a given attack or vulnerability
What to know:
- Take appropriate action on reported security violations by end users and application developers
- Modify ASM policy to adapt to attacks
On this site: Evasion Techniques: How Advanced WAF Normalizes Around Attacker Encoding
Tools: f5-awaf-evasion-explainer, cvss-vector-decoder
3.04 Decide the appropriate method for determining the success of attack mitigation
What to know:
- Choose an appropriate user defined attack signature to respond to particular traffic
Tools: f5-awaf-signature-accuracy-risk

Section 4: TROUBLESHOOT

4.01 Evaluate ASM policy performance issues and determine appropriate mitigation strategies
What to know:
- Analyze performance graphs and statistics along with ASM configurations to determine the root cause of performance issues and appropriate remediation to the configuration based on Guaranteed Logging
4.02 Understand the impact of learning, alarm, and blocking settings on traffic enforcement
What to know:
- Ensure that the security policy is inspecting web application traffic (application is functional and the policies are parsing the traffic)
On this site: Blocking vs Transparent: What Advanced WAF Enforcement Mode Really Does, Signature Staging and the Enforcement Readiness Period
4.03 Examine policy objects to determine why traffic is or is not generating violations
What to know:
- Examine Security Event Logs and ASM configurations to determine expected violations based on the logging profile assigned to the virtual server
On this site: Handling False Positives in Advanced WAF: Triage by Rating, Then Tune with Scope
Tools: f5-awaf-request-log-triage
4.04 Identify and interpret ASM performance metrics
What to know:
- Understand the impact of ASM iRules on performance.
- Understand the impact of traffic spikes on ASM performance and available mitigation strategies
Tools: f5-irules-performance-linter
4.05 Evaluate ASM system performance issues and determine appropriate mitigation strategies
What to know:
- Correlate performance issues with ASM policy changes based on security policy history information and system performance graphs
Tools: f5-awaf-policy-diff
4.06 Recognize ASM specific user roles and their permissions
What to know:
- Recognize differences between user roles/permissions
- Recognize ASM specific user roles

Public sources, used in good faith

These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →