Objective 4.08 Evaluate Whether a Security Policy Is Performing per the Requirements (i.e., Blocking, Transparent, or Other Relevant Security Features) 303 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When evaluating whether an ASM security policy is performing per requirements, what does the principle of balancing availability and security primarily involve?

   • AAdjusting the policy to provide adequate protection while minimizing disruption to legitimate traffic.
   • BEnsuring that the policy blocks all attacks, even if it means some legitimate users are affected.
   • CSetting the policy to transparent mode to avoid any impact on availability.
   • DEnsuring that the policy allows all traffic to avoid any disruption to users.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A PCI compliance report shows that the ASM policy is not blocking 'HTTP Response Splitting' attacks. The administrator finds that the 'HTTP Response Splitting' attack signature is in the 'staging' signature set. What is the most appropriate action to take?

   • AChange the policy's enforcement mode to transparent.
   • BDisable the 'HTTP Response Splitting' signature to reduce false positives.
   • CMove the 'HTTP Response Splitting' signature from the staging set to the enforced set.
   • DLeave the 'HTTP Response Splitting' signature in the staging set and monitor the logs.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An ASM administrator notices a steady increase in SQL injection attempts over the past month, but the number of successful blocks has remained constant. What is the most important trend to communicate to the security team?

   • AThe trend is not important because the blocks are successful and no action is needed.
   • BThe constant block rate means the policy should be switched to transparent mode to reduce false positives.
   • CThe policy is working perfectly because all attacks are being blocked.
   • DThe increase in attack attempts indicates a growing threat that should be monitored and possibly reported to management.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security manager asks the ASM administrator to summarize the top attack types targeting the company's web application over the last quarter. The administrator has access to the ASM reporting tools. What is the most effective way to provide this summary?

   • AProvide a list of the top 10 source IP addresses that generated the most alerts.
   • BCreate a report that shows the count of each attack type (e.g., XSS, SQLi, LFI) over the quarter.
   • CVerbally describe the attacks without any data or visual aids.
   • DExport the raw request logs for the quarter and send them to the manager.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An ASM administrator notices a steady increase in the number of 'evasion technique' violations over the past month. The increase is consistent across multiple virtual servers, and the source IPs are distributed globally. The administrator needs to communicate this trend to the security manager. What is the most appropriate way to present this information?

   • AShow a graph of the violation count over time, segmented by virtual server, and note the global source IP distribution.
   • BProvide a detailed report of the raw logs for each evasion technique violation.
   • CRecommend immediately blocking all traffic from the top 10 source countries.
   • DState that the increase is a false positive and no action is needed.
   Reveal Solution Discussion Select an answer first