Objective 3.02 Determine How a Policy Should Be Adjusted Based Upon Available Data (e.g., Learning Suggestions, Log Data, Application Changes, Traffic Type, User Requirements) 303 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An ASM administrator notices a sudden increase in requests to a web application from a new set of IP addresses that were not previously seen. Which type of data would most directly indicate a change in the application's infrastructure?

   • ATraffic logs showing requests originating from a new range of source IP addresses
   • BAn increase in the number of requests to a specific URL
   • CLearning suggestions showing new parameters being submitted to existing URLs
   • DAttack signatures being triggered by a previously unknown attack pattern
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A web application has added a new parameter to an existing URL. What is the most appropriate way to incorporate this change into the ASM policy?

   • ADisable the parameter check for the URL
   • BCreate a new attack signature for the parameter
   • CChange the enforcement mode to transparent
   • DAdd the parameter to the policy's allowed parameters list
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An ASM policy is in blocking mode. The application team adds a new feature that introduces a new URL path and several new parameters. Users report that legitimate requests to the new feature are being blocked. What should you do first?

   • AImmediately disable the ASM policy to allow users to access the new feature.
   • BChange the policy's enforcement mode to 'Transparent' temporarily.
   • CAdd the new URL and parameters manually to the policy's allowed list.
   • DReview the learning suggestions and accept the new URL and parameters as legitimate.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An ASM policy is in learning mode. The learning suggestions include a suggestion to add a new parameter to a URL. The parameter appears in requests from a small number of IP addresses, and the application team confirms they did not add this parameter. What should you do?

   • AIgnore the suggestion and leave the policy unchanged.
   • BReject the suggestion because the parameter is not part of the application.
   • CAccept the suggestion because it will reduce false positives.
   • DAccept the suggestion but only for the specific IP addresses that used it.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's web application is used by customers in multiple countries. The compliance team requires that the ASM policy not block requests from a specific country due to legal reasons. However, the security team wants to block traffic from that country because of a high number of attacks. What should you do?

   • AAllow traffic from that country but apply stricter security checks, such as additional validation or rate limiting.
   • BAsk the compliance team to change their requirement.
   • CDisable geolocation enforcement entirely to avoid the issue.
   • DBlock traffic from that country to reduce attacks, ignoring the compliance requirement.
   Reveal Solution Discussion Select an answer first