F5 Advanced WAF (ASM) Interview Questions — Models, Staging, Bots & Cheat-Sheet

① WAF fundamentals — why a WAF, and the two security models

F5 WAF interviews open by checking you actually know what a WAF is. Advanced WAF (formerly ASM) is a Layer 7 firewall: it parses the HTTP request and inspects its meaning — the parameters, the body, the signatures, the behaviour. A network firewall works at L3-4 on IPs and ports and is blind to an attack hidden inside a legitimate HTTPS request to port 443.

The F5 WAF vocabulary every interview opens with

Know these four cold before anything else. Tap each card.

Every WAF policy has two halves. The negative security model blocks known-bad using attack signatures. The positive security model allows only known-good — a default-deny map of your application. Advanced WAF uses both, all enforced by one Security Policy object.

② Building & enforcing the policy — learn, stage, then block

You never start from a blank policy. You pick a policy template: Rapid Deployment (fast, few false positives, minimal staging), Fundamental (moderate-to-high tuning, actively blocks during build), or Comprehensive (maximum security, all violations and learning on — expert-only). Then the policy enters Learning mode and builds the app map from real traffic.

The single most important interview point: Enforcement Mode starts at Transparent — violations are logged (each with a Support ID) but nothing is blocked. New signatures and entities sit in Staging, and the enforcement readiness period only completes once the policy is stable. Only then do you flip to Blocking.

③ Advanced protections — bots, L7 DoS, brute force, API & DataSafe

The 'Advanced' in Advanced WAF is the layer above signatures. Proactive Bot Defense fingerprints clients — canvas rendering, JS-engine timing, TLS signature — to separate real browsers from headless tools (Puppeteer, Playwright, Selenium). Behavioral DoS is ML-driven, stress-based L7 DDoS protection that baselines normal behaviour and server health, then mitigates anomalies.

On top of that: brute-force protection and credential-stuffing defence on login forms, API security that enforces an OpenAPI schema and inspects JSON, DataSafe client-side field encryption, and threat campaigns for active real-world attacks.

④ Tuning, ops & troubleshooting — the Support ID loop

Tuning is the job. A false positive is legit traffic wrongly blocked, and you fix it with learning suggestions, not by switching the WAF off. Every blocked request shows a Support ID — paste it into the request log and it leads straight to the violation and the fix.

Know the deployment modes: standalone reverse-proxy, or layered on LTM virtual servers. Either way the WAF is in-path as a full proxy, which is why it can inspect and rewrite L7.

# which enforcement mode is the policy in?
tmsh list asm policy prod_shop_policy enforcement-mode

# is the virtual server (10.20.30.40) protected by an ASM policy?
tmsh list ltm virtual vs_shop_https profiles | grep -i websecurity

# tail the WAF request log for a Support ID seen on the block page
grep "18446744071234567890" /var/log/asm

enforcement-mode transparent
    websecurity { }
support_id="18446744071234567890" violation="Illegal meta character in parameter value" parameter="discount_code" requested_status="blocked"