Over four days you learn to deploy, tune and maintain F5 BIG-IP Advanced WAF to shield web applications from common attacks, credential theft and bots. The content follows F5's Configuring BIG-IP Advanced WAF outline and mixes explanation with labs. It is the groundwork for exam 303 BIG-IP ASM Specialist, which leads to the F5-CTS, BIG-IP ASM title, a required step toward the 401 security expert level.
Explain HTTP exchanges and the vulnerabilities web applications face
Deploy a security policy and handle logs and violations
Use attack signatures, threat campaigns and compliance reporting
Counter brute force, credential stuffing and data leakage, and protect clients with DataSafe
Detect and classify bots and mitigate Layer 7 DoS
Refine the policy: entities, automatic policy building, layered policies, iRules and geolocation
Program
Advanced WAF fundamentals
Web application communication, HTTP headers and vulnerabilities
Threat landscape and policy deployment workflow
Event logging and violation handling
Mitigating vulnerabilities
Attack signatures, threat campaigns and compliance reports
Login enforcement, brute force and credential stuffing
Session tracking, DataSafe and data leakage prevention
Bots and automated attacks
Layer 7 DoS protection and behavioral defense
Bot classification
Guarding against OWASP automated threats: scraping, sign-up abuse, cart and form abuse
Additional deployment options
Entity management, cookie, header and parameter security
Automatic policy building and layered policies
iRules, geolocation and single-page applications
Prerequisites
Networking basics: OSI model, TCP/IP, routing and firewalls
No mandatory prerequisite from F5; the Getting Started with BIG-IP, Getting Started with LTM and Getting Started with F5 Advanced WAF e-learning modules are recommended
Having taken Administering BIG-IP is a plus
Target audience
SecOps staff who deploy, tune and maintain Advanced WAF
Application security administrators
Candidates for exam 303 and the F5-CTS, BIG-IP ASM title
The exam
There is no F5 exam “601”: the web application firewall specialty is exam 303 BIG-IP ASM Specialist. It runs 90 minutes, costs US$180 and is taken at a proctored Pearson VUE center; the passing score is 245. It checks that you can choose an ASM deployment model suited to an application, design a configuration that meets the organization's security requirements, customize policies and place the WAF correctly in the network architecture. Passing earns the F5-CTS, BIG-IP ASM title, which is required for expert exam 401. F5 certifications are valid for two years.
Preparation tips
Redo the labs in transparent then blocking mode to see false positives appear
Download the 303 blueprint and link each objective to a course chapter
Practice reading request logs and deciding whether to accept a violation
Frequently asked questions (FAQ)
Is there an F5 601 exam?
No. F5 has never had an exam 601. The WAF certification is exam 303 BIG-IP ASM Specialist.
ASM or Advanced WAF: what's the difference?
Advanced WAF is F5's current offering and builds on ASM with extra bot and credential protection. The exam keeps the ASM name.
How long is the course?
Four days, with a large share of hands-on labs.
Does this course lead to expert level?
The ASM title it prepares for is one of the prerequisites for exam 401 Security Solutions, together with F5-CA, LTM and APM.
Can I take the course in French?
Yes, we teach it in French or English, live online, in Casablanca or on-site at your organization.