Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by F5
Exam Format
Registration
Validity
Skills this practice test covers
- Match an authentication attack, such as cookie hijacking, with the APM tool that mitigates it.
- Configure AAA servers and SSO profiles, including SAML federation between two BIG-IP systems.
- Choose network access, portal access or an app tunnel to meet a remote access requirement.
- Write L4 and L7 ACLs and choose the allow, continue, discard or reject action.
- Build access policy branches, loops and macros with endpoint checks in the Visual Policy Editor.
- Trace a failed login with HTTP traces, tcpdump captures, SessionDump and the APM logs.
Explore related topics
304 exam content
4 domains · 45 topics · 150 questions
Assess security needs and requirements to create an APM policy27 questions
This section is the planning work before any configuration. Candidates match APM tools and access methods to requirements, and judge how session cookies, endpoint inspection and logging levels affect security and performance.
Skills tested
- Explain how APM mitigates attacks such as cookie hijacking, DoS and password guessing.
- Explain how APM manages domain, host and multi-domain session cookies.
- Choose network, portal or application access for a use case, and weigh its pros and cons.
- Plan how APM works with Microsoft Exchange, SharePoint, Citrix and VMware View.
- Set logging levels and verbosity that meet the requirements without slowing the system.
Questions by topic
- Explain how APM mitigates common attack vectors and methodologies3
- Identify which APM tool(s) should be used to mitigate a specific authentication attack3
- Explain how APM uses and manages session cookies5
- Determine the appropriate access method for a use case3
- Explain the differences among access methods2
- Explain how APM interacts with commonly used applications2
- Explain the differences among logging levels3
- Determine appropriate logging methods and verbosity levels3
- Determine appropriate access methods to meet requirements1
- Describe the use and configuration of endpoint checks1
- Determine the circumstances under which it is appropriate to use an APM specific profile1
Configure and deploy an access profile84 questions
The largest section covers building access on BIG-IP. Candidates choose the profiles a virtual server needs, configure AAA and SSO, set up network access, portal access and app tunnels, and write ACLs and access policy logic.
Skills tested
- Choose APM profiles, such as access, connectivity, rewrite and VDI, and non-APM profiles like ServerSSL.
- Configure AAA servers such as Active Directory, LDAP, RADIUS and RSA, alone or for two-factor logins.
- Set up SSO with HTTP Basic, NTLM, Kerberos, SAML or Forms, including SAML federation between two BIG-IPs.
- Configure network access in SNAT or routed mode, portal access with rewrite options, and app tunnels.
- Write static and dynamic L4 and L7 ACLs, and build branches, loops and macros in the Visual Policy Editor.
Official topics
- Determine the circumstances under which it is appropriate to use an APM specific profile (i.e., access, connectivity, rewrite, VDI and Java support)
- Determine the circumstances under which it is appropriate to use a non-APM specific profile (e.g., ServerSSL, Web Acceleration, Compression)
- Explain how to create and assign an SSL profile
- Determine appropriate SNAT settings to meet access requirements for Network Access (e.g., VoIP, Active mode FTP, Remote Desktop to Network Access Clients)
- Explain the characteristics (e.g., pros and cons, restrictions, security implications, HA setup) of available AAA profiles
- Explain the characteristics (e.g., pros and cons, restrictions, security implications) of available SSO profiles
- Explain the implications of passwordless authentication options in APM and how they affect SSO (e.g., SAML, Client certificate, NTLM-end-user)
- Explain how to configure AAA profiles (e.g., HTTP Basic, AD, LDAP, Radius, TACACS, KERBEROS, RSA, SAML, OCSP, CRLDP)
- Explain techniques to simultaneously configure multiple AAA profiles (e.g., two-factor)
- Explain how to configure SSO profiles (e.g., HTTP Basic, NTLM, KERBEROS, SAML, Forms)
- Explain how to configure SAML use cases (e.g., IDP, SP, IDP-initiated, SP-initiated)
- Describe how to add and remove client and machine certificates
- Determine appropriate deployment option(s) to meet network access requirements (e.g., standalone edge client, browser components, mobile apps)
- Explain how to configure access methods (e.g., network [SNAT vs. Routed Mode], portal [rewrite options], application, app tunnel, LTM+APM)
- Determine appropriate access methods (e.g., network, portal, application, LTM+APM) to meet requirements
- Explain how to configure and assign ACLs (e.g., L4, L7, static, dynamic, default action, iRule events, logging options)
- Identify resource types for which associated ACLs are automatically created (e.g., remote desktop, portal access, application tunnels)
- Describe the ACL action types and their functions (e.g., allow, continue, discard, reject)
- Describe methods to map Microsoft Active Directory groups to assigned resources
- Explain the use of APM session variables (e.g., session flow, use in iRules, variable assign policy item)
- Explain access policy flow and logic (i.e., branching, loops, macros [when and how to use them])
- Describe the use and configuration of endpoint checks (e.g., registry check, process check, Windows info, machine cert auth)
- Describe customization options for an access policy (logon page, webtop, network access, language)
Maintain APM access profiles10 questions
This short section covers APM after it goes live. Candidates read performance reports, follow safe upgrade steps, and predict how upgrades and failover affect users.
Skills tested
- Read the dashboard, the statistics tab and the ACL denied report.
- List the steps of a safe upgrade, starting with a backup.
- Predict what users notice when client components update or an active device fails over to standby.
Questions by topic
- Interpret device performance information4
- Identify necessary software maintenance procedures to address a given condition3
- Determine how upgrades on production systems affect end users3
Identify and resolve APM issues29 questions
When access fails, candidates find out where it broke: between the client and APM, between APM and the AAA server, or between APM and SSO. They read certificates, HTTP traces, packet captures and APM logs to find the cause.
Skills tested
- Explain client side components such as the DNS Proxy Relay service and the Component Installer service.
- Read an HTTP trace from HTTPWatch or Fiddler to see where authentication fails.
- Capture traffic with tcpdump and ssldump, and read the output.
- Find the root cause of a login problem in the APM, SSO and rewrite logs.
- Use SessionDump, the ADTest tool and LDAP search to test sessions and directory lookups.
Questions by topic
- Explain the purpose and function of client side components4
- Interpret an HTTP protocol trace collected with a client side tool3
- Explain how to use capture utilities4
- Analyze and interpret APM-specific log files3
- Describe the use of built-in trouble-shooting tools5
- Diagnose and resolve authentication issues4
- Diagnose and resolve client side issues related to connections, performance, and endpoint inspection4
- Interpret client and machine certificates2
Requirements
- Required: a valid F5 Certified BIG-IP Administrator (F5-CA) certification.
- Recommended: F5's Configuring BIG-IP Access Policy Manager (APM) course.
- Recommended: hands-on experience with BIG-IP APM.
About the 304 exam
Exam 304 checks that an administrator can plan, configure, maintain and troubleshoot BIG-IP Access Policy Manager (APM). APM decides who can reach which application, and how. Most of the blueprint is about configuring and deploying access profiles, from AAA servers and single sign-on to network access, ACLs and access policy logic. Candidates must already hold the F5 Certified BIG-IP Administrator certification, and passing earns F5 Certified Technology Specialist, APM.
The Configure and deploy an access profile section has the most objectives in F5's blueprint, and it also gets the most questions in the PlanetCert practice test. The explanations compare options that look alike, such as SNAT and routed mode for network access, or the discard and reject ACL actions. Study Mode suits the troubleshooting section, where each answer depends on a careful reading of a log line or an HTTP trace. Brainy AI Assistant can walk through a Visual Policy Editor branch or explain what SessionDump output shows.
How to earn the certification
- Earns
- F5 Certified Technology Specialist, APMTechnology Specialist
- Before
- 201 TMOS Administration
A BIG-IP administration exam on the route to F5 Certified BIG-IP Administrator. That certification is required before 304.
- 201 TMOS Administration
- After
- 401 Security Solution Expert
F5's expert-level security exam. Its prerequisites include this APM certification and BIG-IP ASM Specialist.
- 401 Security Solution Expert
How to prepare for 304
- 1
Check the F5-CA requirement
Booking 304 needs a valid F5 Certified BIG-IP Administrator certification. Confirm that it is still current before planning study time.
- 2
Build an APM lab with a directory
Run a BIG-IP system with APM next to an Active Directory or LDAP server and one internal web application. Then reach that application once through each access method: network access, portal access and an app tunnel.
- 3
Give access profiles most of the hours
The Configure and deploy an access profile section holds most of the blueprint's objectives. Work through AAA servers, SSO profiles, SAML federation, ACLs and endpoint checks, and build each policy in the Visual Policy Editor.
- 4
Break logins on purpose
Make SSO or AAA fail, then find the fault with an HTTPWatch or Fiddler trace, tcpdump and ssldump, SessionDump and the APM log. The troubleshooting section expects this kind of reading.
- 5
Finish with a timed run
Take the 304 practice test in Study Mode one section at a time, then a full run in Timed Mode. Repeat each missed SSO or ACL case in the lab, and ask Brainy AI Assistant to explain the policy flow.
Start a timed 304run
F5 recommends its instructor-led Configuring BIG-IP Access Policy Manager (APM) course.
Who 304 is for
- BIG-IP administrators with F5-CA who run remote access for their organization.
- Security engineers who set up single sign-on and SAML federation for internal applications.
- Network engineers who support remote users on Network Access and the Edge Client.
- Candidates for Security Solution Expert, which lists this certification as a prerequisite.
Typical job titles: Network security engineer · BIG-IP administrator · Identity and access engineer · Application delivery engineer · Network engineer
304 glossary
19 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- AAA
- Authentication, authorization and accounting. In APM, AAA servers such as Active Directory, LDAP or RADIUS check who the user is.
- Access profile
- The APM profile attached to a virtual server. It holds the access policy that every user session runs through.
- ADTest
- A built-in tool that tests the queries the BIG-IP system sends to an Active Directory server.
- App tunnel
- An access method that carries one application's TCP traffic through APM, instead of opening the whole network.
- Edge Client
- F5's client software that a user installs to connect through Network Access.
- Endpoint checks
- Checks that APM runs on the client device, such as a registry, process, file, firewall or antivirus check, before it allows access.
- L7 ACL
- An APM access control list rule that matches application details, such as a URL path. An L4 ACL matches only addresses and ports.
- Network Access
- The APM access method that gives a remote client a VPN connection to the internal network.
- OPSWAT
- The third-party endpoint inspection technology that APM integrates to check items such as antivirus and firewall status on a client.
- Portal access
- The APM access method that publishes internal web applications and rewrites their links so they work from outside.
- Routed Mode
- A Network Access option in which client traffic keeps its assigned address and the network routes replies back, instead of using SNAT.
- SAML
- A standard for passing sign-in data between an identity provider (IdP) and a service provider (SP). APM can act as either one.
- Session variables
- Values that APM stores for each user session, such as the user name, which policy items and iRules can read or set.
- SessionDump
- A built-in APM troubleshooting tool that lists the session variables of active sessions.
- SNAT
- A setting that changes the source address of client traffic, so that server replies come back through the BIG-IP system.
- SSO
- Single sign-on: APM passes the user's credentials on to back-end applications, so the user does not log in again.
- TMOS
- The F5 operating system that BIG-IP modules such as APM run on. The 304 blueprint is based on version 11.3.
- Visual Policy Editor (VPE)
- The graphical editor in APM for building an access policy as a flow of items, branches and endings.
- Webtop
- The page users see after they log on. It lists the resources that APM has assigned to them.