BIG-IP APM Specialist: secure application access

4 Sub-Modules | 14 Lessons

• Configuring the different AAA methods (AAA objects for Active Directory, LDAP, Radius, RSA SecurID, TACACS, Kerberos and NTLM, client certificate authentication, and the end-point management system profile)

• The network requirements for each authentication service type (testing and validating connectivity, reading adtest and ldapsearch output)

• Configuring SSO objects (specific requirements such as Kerberos SPNs, and choosing one SSO type over another)

• SAML as Service Provider and Identity Provider (integrating APM as SP with an external IdP such as PING or Okta, and configuring Single Logout)

5 Sub-Modules | 16 Lessons

• SSL VPN configuration, manually and with the wizard (choosing between network access, portal access and web application access, and the right webtop type)

• Network Access Profiles (connectivity profile options, Edge Client options and updates, SNAT, and App Optimization)

• Portal access (the appropriate level of patching, evaluating global ACL order, configuring resource items)

• Application access (Remote Desktop including launching applications and custom parameters, the Citrix bundle, and App Tunnels)

• Web Access Management in LTM-APM mode (pool and virtual server configuration, and when this is the right choice)

4 Sub-Modules | 14 Lessons

• Authentication and logon objects in the VPE (auth and query objects, determining group membership, required attributes, and the right logon page type)

• Resource and custom variables (SSO credential mapping, assigning webtops dynamically, variable assignment)

• VPE flow with multiple branches and objects (policy ending types of allow, deny and redirect, message boxes displaying a variable, custom session variables)

• Macros (combining multiple VPE objects, and the difference between creating a macro and creating an access policy)

3 Sub-Modules | 10 Lessons

• When to use an iApp (importing and deploying supported templates, the module versions a template supports, and which modules it requires)

• Maintaining iApps (reconfiguring a deployed iApp to update objects, and identifying which iApp deployed a given object)

• Strict updates (making manual changes to a deployed application service, and understanding the consequences of disabling strict updates)

6 Sub-Modules | 18 Lessons

• Managing and maintaining access profiles (profile scope at profile, virtual server and global level, and tuning for concurrent users and session limits per IP)

• Customising the user interface (corporate branding, logos, footers and logon forms, and additional languages for browser localisation)

• High availability as it applies to APM (the two units per HA pair and traffic group limitation, and configuring and validating Access Policy Sync)

• Provisioning and licensing (updating an existing APM licence, and CCU utilisation across different access policy deployments)

• Gathering the relevant data (session reports, session variables, tcpdump, ssldump, sessiondump, the APM log, debug logic in APM iRules, and debug logging)

• Determining root cause (expected versus actual behaviour, correlating client, BIG-IP and server side data, and the causes of EPSEC failures)

8 Sub-Modules | 24 Lessons

• How APM mitigates common attack vectors (cookie hijacking, DoS attacks, the BIG-IP features that mitigate them, and deploying GeoIP and IP intelligence in the VPE)

• Mitigating a specific authentication attack (logging configuration, the objects needed to deploy MFA, SNMP traps)

• Managing user sessions (session details, and how APM session cookies actually behave)

• Secure Web Gateway use cases (transparent versus explicit proxy deployments, and what SWG is for)

• Access policy timeouts as a security control (inactivity timeout, access policy timeout and maximum session timeout, and the difference between them)

• Configuring and managing ACLs (how they are deployed by default with a policy, and when a Layer 4 or Layer 7 ACL is needed)

• Network security requirements for application access (the TCP and UDP ports each application service requires)

• Implementing EPSEC (client-side checks for anti-virus, firewall and registry, and updating and installing EPSEC software)

Yes. Passing 304 earns F5 Certified Technology Specialist, APM. It is a single exam, unlike the LTM track which needs both 301a and 301b.

Yes. F5 Certified Administrator, BIG-IP (F5-CA) is required before any 3xx specialist exam. Since May 2025 that credential is earned by passing five short exams, F5CAB1 through F5CAB5, rather than the old 201.

Yes, and APM needs them more than most. Demonstrations cover AAA objects, SSO credential mapping, SAML SP and IdP configuration, network and portal access, and the Visual Policy Editor built up branch by branch. Each authentication method is also broken deliberately, so you learn what the failure looks like in adtest, ldapsearch and the APM log rather than only seeing it work.

It is the broadest. Six sections and thirty objectives, more than any other specialist exam, and the scope runs from Kerberos SPNs to Citrix bundles to EPSEC client checks. It is not conceptually harder than 301b, but there is more of it, and the sections are genuinely distinct rather than variations on a theme. The course keeps them separate for that reason.

Another specialist certification, depending on where your work sits: 301a and 301b (LTM), 302 (DNS) or 303 (ASM). APM pairs naturally with ASM for security work, though the 401 Security Solutions Expert track requires LTM specifically as its prerequisite.