Which one is applied when both rate limiting and captcha challenge for device ID in a DOS profile?

Hello,

you can check out this below link, it is mentioned that:

"The mitigation methods that you select are used in the order they appear on the screen. The system enforces the methods only as needed if the previous method was not able to stem the attack."

https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-asm-implementations-14-1-0/preventing-dos-attacks-on-applications.html

So the order should be:

1. JavaScript challenges (also called Client-Side Integrity Defense)
2. CAPTCHA challenges
3. Request blocking (including Rate Limit or Block All)

Thanks,

Mohamed Salah