Objective 3.02 Determine How a Policy Should Be Adjusted Based Upon Available Data (e.g., Learning Suggestions, Log Data, Application Changes, Traffic Type, User Requirements) 303 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When prioritizing policy adjustments, which factor should be considered most important for business continuity?

   • AThe number of learning suggestions
   • BThe number of users affected
   • CThe severity of attacks being blocked
   • DThe performance impact of the policy
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company migrates its web application from a single server to a load-balanced cluster behind a new reverse proxy. After the migration, the ASM policy begins generating false positives on requests that were previously considered normal. What is the most likely reason for this?

   • AThe reverse proxy is adding a new header that the ASM policy does not recognize, causing it to treat the request as anomalous.
   • BThe new infrastructure is slower, causing timeouts that ASM interprets as attacks.
   • CThe policy's IP intelligence feature is now blocking the proxy's IP address, which is different from the original server's IP.
   • DThe load balancer is distributing traffic unevenly, causing some servers to receive more requests than others.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After adding a new web application firewall (WAF) in front of the ASM, the ASM policy starts blocking legitimate traffic. The WAF is configured to add a custom header to all requests. What should you do to resolve this?

   • ARemove the custom header from the WAF configuration.
   • BAdd the custom header to the policy's allowed headers list.
   • CDisable the ASM policy's header enforcement to allow the custom header.
   • DChange the ASM policy's enforcement mode to 'Transparent' to stop blocking.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company's ASM policy has been in blocking mode for months. The security team notices a sudden increase in false positives. The application team reports that they recently added a content delivery network (CDN) in front of the application. The CDN is configured to cache static content and modify the User-Agent header. What is the most likely cause of the false positives?

   • AThe CDN's IP addresses are being blocked by the IP intelligence feature.
   • BThe CDN is changing the User-Agent header, causing the policy to flag requests as anomalous.
   • CThe CDN is caching dynamic content, causing the policy to see stale data.
   • DThe CDN is causing the application to respond slower, leading to timeouts that ASM flags as attacks.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An ASM policy for a web application has been stable for months. Recently, the security team notices a sharp increase in requests to a specific URL path that previously had very low traffic. The requests come from a wide range of IP addresses and include unusual query parameters. The application team confirms they did not add any new features. What is the most likely cause and the appropriate first step?

   • AThe application is under a distributed brute-force attack; immediately enable blocking mode for all signatures.
   • BThe policy is failing to detect attacks; increase the enforcement readiness level to 'High' to improve detection.
   • CA new load balancer or proxy is now routing traffic to the application, changing the observed traffic pattern; review the traffic source and headers to confirm.
   • DThe application is being accessed by a new legitimate client that uses different query parameters; add these parameters to the policy as allowed.
   Reveal Solution Discussion Select an answer first