Objective 2.04 Refine Policy Structure for Policy Elements (e.g., URLs, Parameters, Files Types, Headers, Sessions and Logins, Content Profiles, CSRF Protection, Anomaly Protection) 303 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When defining a parameter policy for a login form, which attribute would you use to specify that the 'username' parameter must contain only alphanumeric characters?

   • AMaximum length
   • BAllowed values
   • CData type
   • DEnforcement action
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In an ASM header policy, what is the purpose of defining a header with a 'Block' enforcement action?

   • ATo remove the header from the request before forwarding
   • BTo reject requests that contain the specified header
   • CTo add the header to the response
   • DTo log the header for analysis
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of session tracking in ASM?

   • ATo balance load across servers
   • BTo maintain state and correlate requests within a user session
   • CTo store user passwords securely
   • DTo cache static content
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of configuring a file type policy in ASM?

   • ATo encrypt files during transmission
   • BTo scan files for malware
   • CTo allow or block specific file uploads and downloads based on type and size
   • DTo compress files to reduce bandwidth
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A web application has a login page that is protected by ASM login protection. The security team wants to block brute force attacks, but they also want to allow legitimate users who have a valid session cookie. The ASM policy is in blocking mode and is blocking legitimate users who have a valid session cookie but are still being blocked. What should you configure?

   • AUse the anomaly detection to block only suspicious IPs.
   • BDisable login protection for the login page.
   • CConfigure login protection to ignore requests that have a valid session cookie.
   • DIncrease the failed login attempt threshold.
   Reveal Solution Discussion Select an answer first