Objective 4.08 Evaluate Whether a Security Policy Is Performing per the Requirements (i.e., Blocking, Transparent, or Other Relevant Security Features) 303 Practice Questions (Page 4)

Questions 16–18

1. 16expert · hard

   A company's ASM policy is in blocking mode. The security team wants to ensure that a new application is protected, but the application team is concerned that the policy might block legitimate user requests. The administrator needs to evaluate the policy's performance in a way that balances security and availability. What is the most appropriate approach?

   • AUse the policy's learning mode to automatically adjust the policy without manual review.
   • BRun the policy in transparent mode for a period to observe violations and false positives.
   • CDisable all attack signatures and rely on the application team's input.
   • DImmediately enforce the policy in blocking mode and address any issues as they arise.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A PCI compliance report shows that the ASM policy is not blocking 'Local File Inclusion' (LFI) attacks. The administrator finds that the 'LFI' attack signature is in the 'staging' signature set. What is the most appropriate action to take?

   • ADisable the LFI signature to reduce false positives.
   • BChange the policy's enforcement mode to transparent.
   • CLeave the LFI signature in the staging set and monitor the logs.
   • DMove the LFI signature from the staging set to the enforced set.
   Reveal Solution Discussion Select an answer first
3. 18application · medium

   A PCI compliance report indicates that the ASM policy is not blocking 'SQL Injection' (SQLi) attacks. The administrator checks the policy and finds that the 'SQL Injection' attack signature is not enabled. What should the administrator do to resolve this compliance issue?

   • AEnable the 'SQL Injection' attack signature in the policy.
   • BVerify that the 'SQL Injection' signature is in the staging set and leave it there.
   • CReview the policy's learning mode to see if it is suggesting the signature.
   • DChange the policy's enforcement mode from blocking to transparent.
   Reveal Solution Discussion Select an answer first