Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by F5
Exam Format
90 min
245
Technology Specialist
Registration
$180 USD
Pearson VUE
English
Validity
Maintain via F5's certification renewal program (recertify before certification expiration)
304 Exam Topics and Domains
304 is organized into 4 weighted domains.
1
Assess security needs and requirements to create an APM policy
19%
Identify which APM tool(s) should be used to mitigate a specific authentication attack
Explain the differences among access methods (e.g., network, portal, access management)
Explain how APM mitigates common attack vectors and methodologies (e.g., cookie hijacking [front and back], DoS attack)
Describe common attack vectorsDescribe cookie function in common browsersCompare authentication methods
Explain how APM uses and manages session cookies (domain, host, multi-domain)
Determine endpoint inspection requirements (e.g., OPSWAT, registry check)Describe the process to mitigate password guessing attacks
Determine the appropriate access method for a use case or set of requirements
Distinguish among network communication, security, and reporting requirements and note pros and consExplain how security permissions on client PCs affect use cases
Explain how APM interacts with commonly used applications (e.g., Microsoft Exchange, Citrix, VMware View, SharePoint)
Explain how APM interacts with a virtual desktop infrastructure (e.g., VMware View, Citrix, RDP)Compare access modesDetermine deployment configurations with commonly used applications
Explain the differences among logging levels (e.g., performance implications, security implications, information provided)
Explain how APM uses TMOS facilities for loggingInterpret log messages and the data contained within them
Determine appropriate logging methods and verbosity levels to meet specified requirements
Explain the various levels of verbosity availableDetermine appropriate verbosity levelsExplain the performance implications of extended loggingExplain security and privacy implications of log settings
2
Configure and deploy an access profile
55%
Determine the circumstances under which it is appropriate to use an APM specific profile (i.e., access, connectivity, rewrite, VDI and Java support)Determine appropriate access policy configurations to assign to the virtual server
Determine the circumstances under which it is appropriate to use a non-APM specific profile (e.g., ServerSSL, Web Acceleration, Compression)Compare non-APM specific profiles when configuring a virtual server
Determine appropriate SNAT settings to meet access requirements for Network Access (e.g., VoIP, Active mode FTP, Remote Desktop to Network Access Clients)Determine appropriate SNAT settings when troubleshooting failing connections
Explain the characteristics (e.g., pros and cons, restrictions, security implications, HA setup) of available AAA profilesDistinguish among/compare and contrast the different AAA types
Explain the characteristics (e.g., pros and cons, restrictions, security implications) of available SSO profilesDistinguish among/compare and contrast the different SSO types
Explain the implications of passwordless authentication options in APM and how they affect SSO (e.g., SAML, Client certificate, NTLM-end-user)Relate passwordless options to SSO behavior
Explain how to configure AAA profiles (e.g., HTTP Basic, AD, LDAP, Radius, TACACS, KERBEROS, RSA, SAML, OCSP, CRLDP)Configure AAA server objects
Explain how to configure SAML use cases (e.g., IDP, SP, IDP-initiated, SP-initiated)Configure SAML federation between two BIG-IPs
Describe how to add and remove client and machine certificates
Determine appropriate access methods (e.g., network, portal, application, LTM+APM) to meet requirements
Identify resource types for which associated ACLs are automatically created (e.g., remote desktop, portal access, application tunnels)
Describe the ACL action types and their functions (e.g., allow, continue, discard, reject)Identify the ACL action types (allow, continue, discard, reject)
Describe methods to map Microsoft Active Directory groups to assigned resources
Explain the use of APM session variables (e.g., session flow, use in iRules, variable assign policy item)Use the iRule event policy item in the VPE and modify access policy to meet authentication requirements
Explain access policy flow and logic (i.e., branching, loops, macros [when and how to use them])Understand branching, loops and macros in the Visual Policy Editor
Describe customization options for an access policy (logon page, webtop, network access, language)Identify policy items (client side, service side, general purpose) and branch endings (allow, deny, redirect)
Explain how to create and assign an SSL profile
Describe the process to upload the SSL certificate and keyDetermine which SSL profile to assign to the virtual server
Explain techniques to simultaneously configure multiple AAA profiles (e.g., two-factor)
Explain high availability options for AAA profilesDescribe differences and similarities between authentication methodsExplain the process to set up an APM device to use HTTPS authentication
Explain how to configure SSO profiles (e.g., HTTP Basic, NTLM, KERBEROS, SAML, Forms)
Describe SSO profilesDetermine the correct configurations to resolve SSO performance issues
Determine appropriate deployment option(s) to meet network access requirements (e.g., standalone edge client, browser components, mobile apps)
Describe the different access methods: portal access, app tunnel, network access, LTM+APM functionalityList APM device clients and determine required Edge Client component
Explain how to configure access methods (e.g., network [SNAT vs. Routed Mode], portal [rewrite options], application, app tunnel, LTM+APM)
Determine best deployment option for network accessConfigure application access (e.g., app tunnel, RDP, VDI)Explain protocol restrictions on application tunnels (i.e., TCP)Determine when Java support is needed for RDP (e.g., Mac and Linux clients)Configure portal access and custom rewrite options (e.g., split tunnel, client caching)
Explain how to configure and assign ACLs (e.g., L4, L7, static, dynamic, default action, iRule events, logging options)
Explain the difference between Layer 7 and Layer 4 ACLsExplain static vs dynamic ACLs and how ACLs are processedExplain the default ACL action (e.g., default allow) and describe ACL logging options
Describe the use and configuration of endpoint checks (e.g., registry check, process check, Windows info, machine cert auth)
Configure endpoint checks: AV check, registry check, file check, firewall check, process check, machine certificate checkDetermine steps to add macro checks and authentication methods to a policy
3
Maintain APM access profiles
7%
Interpret device performance information (e.g., dashboard, statistics tab, ACL denied report)Read the dashboard, statistics tab, and ACL denied report
Determine how upgrades on production systems affect end users (e.g., client components and high availability failover)Assess end-user impact of client component updates and HA failover
Identify necessary software maintenance procedures to address a given condition
List steps for a safe upgrade (e.g., perform a backup before upgrading)Describe OPSWAT integration and appropriate monitoring facilitiesPredict device behavior during upgrade and HA failover
4
Identify and resolve APM issues
19%
Explain the purpose and function of client side components (e.g., DNS Proxy Relay service, Component Installer service for Windows, User Logon Credentials Access Service for Windows)Describe client-side services
Interpret client and machine certificates (e.g., subject, issuer)Read certificate subject and issuer during client certificate configuration
Interpret an HTTP protocol trace collected with a client side tool (e.g., HTTPWatch, Fiddler, Paros, Live Headers)Perform and interpret an HTTPWatch capture; describe SSO methods for an APM-delivered web app
Explain how to use capture utilities (e.g., SSLDump and TCPDump)Perform and interpret TCPDump/SSLDump output to resolve specific issues
Analyze and interpret APM-specific log files (e.g., APM, SSO, rewrite)Identify error messages and determine root cause of login issues from log files
Describe the use of built-in trouble-shooting tools (e.g., web engine trace, F5 Troubleshooting Utility, SessionDump, ADTest tool, LDAP search)Locate error codes and core files; list APM logging services
Diagnose and resolve authentication issues (e.g., client>APM, APM>AAA, APM>SSO)Analyze HTTP requests to determine authentication issues
Diagnose and resolve client side issues related to connections, performance, and endpoint inspectionDetermine root cause and differentiate types of authentication and client-side issues
How do I earn this certification?
Passing 304 earns the F5 Certified! Technology Specialist, Access Policy Manager (APM) certification. It sits in the Security / Access Policy Manager track.
Current Level Exams
- 303 - BIG-IP ASM Specialist
- 301a - BIG-IP LTM Specialist: Architect, Setup, and Deploy
- 301b - BIG-IP LTM Specialist: Maintain and Troubleshoot
Next Level Options
401 - Security SolutionsRequires the LTM, ASM, and APM Specialist certifications as prerequisites
Alternative Paths
- 303 - BIG-IP ASM SpecialistCompanion security specialist certification on the Security Solutions Expert track
- 301a - BIG-IP LTM Specialist Required specialist certification for the Security Solutions Expert track
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for 304 is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: Blueprint V1_2013 (exam based on TMOS v11.3); no newer blueprint version found on official sources this run
Updates
BIG-IP APM (Access Policy Manager) TMOS v11.3 (exam basis) Blueprint objectives reference v11-era APM features (Visual Policy Editor, AAA/SSO/SAML, network/portal/application access, endpoint checks).
Who should take this exam?
Valid F5-CA, BIG-IP Certification (F5 Certified BIG-IP Administrator)
- Configuring BIG-IP Access Policy Manager (APM) course
- Hands-on experience with BIG-IP APM