Objective 4.08 Evaluate Whether a Security Policy Is Performing per the Requirements (i.e., Blocking, Transparent, or Other Relevant Security Features) 303 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An ASM administrator is preparing a monthly report for the CISO. The report should highlight the most significant security trends. The administrator notices a sharp increase in 'HTTP Protocol Compliance' violations from a specific internal IP address. What is the most appropriate way to communicate this finding?

   • AIgnore the trend because it is from an internal IP address.
   • BAdd a section to the report that shows the trend of these violations over time, noting the source IP.
   • CInclude the raw violation logs for the specific IP address in the report.
   • DRecommend blocking the internal IP address immediately.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company's ASM policy is in blocking mode. The administrator is evaluating the policy's performance and notices that a legitimate business application is being blocked because it sends requests that match the 'Command Injection' attack signature. The application team says the request format is required and cannot be changed. The administrator must balance security and availability. What is the most appropriate action?

   • ACreate a specific rule to allow the legitimate request pattern from the application's source IP.
   • BSwitch the entire policy to transparent mode.
   • CDisable the 'Command Injection' attack signature entirely.
   • DAdd the application's source IP to the IP exception list.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A PCI compliance report indicates that the ASM policy is not blocking 'Remote File Inclusion' (RFI) attacks. The administrator checks the policy and finds that the 'RFI' attack signature is not enabled. What should the administrator do to resolve this compliance issue?

   • AChange the policy's enforcement mode from blocking to transparent.
   • BVerify that the 'RFI' signature is in the staging set and leave it there.
   • CEnable the 'RFI' attack signature in the policy.
   • DReview the policy's learning mode to see if it is suggesting the signature.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's ASM policy is in blocking mode. The administrator is evaluating the policy's performance and notices that a high volume of 'HTTP Protocol Compliance' violations are being blocked. The violations are from a legitimate API client that is sending requests with a non-standard HTTP method. The API team says the method is required for their application. The administrator must balance security and availability. What is the most appropriate action?

   • ADisable the 'HTTP Protocol Compliance' check entirely.
   • BAdd the non-standard HTTP method to the policy's allowed methods list.
   • CAdd the API client's source IP to the IP exception list.
   • DSwitch the entire policy to transparent mode.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A PCI compliance report shows that the ASM policy is not blocking 'Cross-Site Request Forgery' (CSRF) attacks. The administrator finds that the 'CSRF' attack signature is not enabled. What should the administrator do to resolve this compliance issue?

   • AEnable the 'CSRF' attack signature in the policy.
   • BReview the policy's learning mode to see if it is suggesting the signature.
   • CChange the policy's enforcement mode from blocking to transparent.
   • DVerify that the 'CSRF' signature is in the staging set and leave it there.
   Reveal Solution Discussion Select an answer first