Objective 2.01 Determine the Appropriate Criteria for Initial Policy Definition Based on Application Requirements (e.g., Wildcards, Violations, Entities, Signatures, User-Defined Signatures) 303 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is deploying ASM for a web application that uses a session cookie named 'JSESSIONID' and a tracking cookie named 'analytics'. The application also accepts file uploads of images (PNG, JPG). The security team wants to ensure that ASM inspects these elements. Which entity configuration is most appropriate for the initial policy?

   • AAdd a wildcard cookie entity and a wildcard file type entity.
   • BAdd only the file type entities and do not define any cookies.
   • CAdd only 'JSESSIONID' as a cookie entity and leave 'analytics' undefined.
   • DAdd 'JSESSIONID' and 'analytics' as cookie entities, and add PNG and JPG as allowed file type entities.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When should a user-defined signature be created?

   • AWhen the application is accessed by a large number of users
   • BWhen the application has a specific vulnerability that is not addressed by existing signatures
   • CWhen the application uses a common technology like Apache
   • DWhen the application is hosted in the cloud
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which application characteristic is a primary consideration when defining the initial ASM policy?

   • AThe operating system of the client devices
   • BThe network bandwidth available to the application
   • CThe application's purpose and the types of data it processes
   • DThe physical location of the application servers
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary factor in determining which attack signatures to enable in an ASM policy?

   • AThe application's technology stack
   • BThe number of users accessing the application
   • CThe geographic location of the application
   • DThe color scheme of the application's UI
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which action is appropriate when the application uses a technology that is not covered by the default signature set?

   • AIgnore the technology and rely on other security controls
   • BCreate a user-defined signature to address the specific technology
   • CDisable all signatures for that application
   • DUpgrade the application to a different technology
   Reveal Solution Discussion Select an answer first