Objective 4.08 Evaluate Whether a Security Policy Is Performing per the Requirements (i.e., Blocking, Transparent, or Other Relevant Security Features) 303 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An ASM administrator reviews the PCI compliance report and finds that the policy is not blocking a specific attack signature that the report flags as a requirement. What is the most appropriate first step to resolve this issue?

   • AEnable the corresponding attack signature in the policy and set it to blocking, then re-run the PCI report to verify compliance.
   • BIgnore the report item because the signature is not relevant to the application's traffic profile.
   • CChange the policy's enforcement mode to transparent to allow the traffic and avoid false positives.
   • DDelete the attack signature from the policy to remove the violation from the report.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An ASM administrator is reviewing the PCI compliance report and finds that the policy is not blocking requests with a 'Cross-Site Scripting (XSS)' attack signature. The signature is in the 'staging' signature set. The policy is in blocking mode. What should the administrator do to ensure the policy meets the PCI requirement?

   • AMove the XSS signature from the staging set to the enforced set.
   • BChange the policy enforcement mode to transparent to allow the traffic.
   • CLeave the signature in staging and rely on the logging to detect attacks.
   • DDisable the XSS signature to reduce false positives.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When presenting ASM security data to non-technical stakeholders, what is the most effective way to communicate important trends?

   • AOnly report the number of false positives, as that is the most important metric.
   • BProvide raw log files and technical signature names for each event.
   • CAvoid sharing any data that might alarm stakeholders unnecessarily.
   • DSummarize the trends in business terms, such as the number of blocked attacks and their potential impact.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An ASM administrator is reviewing the weekly security report and notices a significant increase in 'Bad HTTP Request' violations. The increase is coming from a new IP range that was recently added to the company's network. What is the most appropriate way to communicate this to the network team?

   • AIgnore the increase because it is from a new IP range.
   • BCreate a summary that shows the increase in violations and the source IP range.
   • CRecommend blocking the new IP range immediately.
   • DSend the network team the raw logs for all 'Bad HTTP Request' violations.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An ASM administrator must decide whether to enable a new blocking rule that may cause occasional false positives for legitimate users. What is the primary risk management consideration when making this decision?

   • AThe decision should be based solely on the number of attacks the rule will block.
   • BThe rule should never be enabled because any false positive is unacceptable.
   • CThe rule should always be enabled because security is the top priority over availability.
   • DThe decision should weigh the risk of the attack against the impact of false positives on legitimate users.
   Reveal Solution Discussion Select an answer first