ASM and AAM can run without LTM ?!

Off the top of my head, without LTM license, you cannot do load balancing (you can only have one pool member). You should be able to create a VIP with a single pool member and attach an ASM policy and have it run in transparent mode.

The idea of LTM being down while ASM is up is not entirely correct. If LTM is down, then the entire device cannot pass production traffic, as it is the heart of the system. LTM is the one that hands off traffic to ASM an other modules for inspection and any other policy required by the provisioned modules and attached profiles.

However, you can configure the device so that LTM continues to pass traffic when ASM is down, although this is not enabled by default, and often not a very good idea.

Assuming that you are using AAM, you might want to break your design up so that the virtual server hosting the content you want to cache is different from the one hosting the content you want to protect with ASM. In my view, there's not much to be gained by putting ASM in front of static assets like images and CSS files etc, which are the ones that benefit from AAM. This keeps things simple and more manageable.

I hope this helps.