Objective 2.03 Review and Evaluate Rules Based on Information Gathered from ASM (e.g., Attack Signatures, DataGuard, Parameters, Entities) 303 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   While reviewing ASM logs, an administrator notices an attack signature match for a known SQL injection pattern. What is the primary purpose of reviewing this attack signature match in the context of policy evaluation?

   • ATo verify that the signature is correctly named in the signature database
   • BTo determine the IP address of the attacker and block it permanently
   • CTo automatically update the signature database with new patterns from the log
   • DTo identify the specific attack pattern and assess whether the policy is effectively blocking or detecting it
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An ASM log shows a high number of requests triggering a specific attack signature. What should the administrator do first when evaluating this information?

   • ADisable the signature immediately to reduce log noise
   • BReview the signature details and the requests that matched to determine if the traffic is malicious or a false positive
   • CIgnore the log entries because signature matches are always accurate
   • DIncrease the enforcement mode of the signature to block all matching requests
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A review of ASM entity data shows that a specific URL '/admin/config.php' is receiving a high number of requests with unusual 'User-Agent' headers. The requests are not matching any attack signatures. The URL is not linked from any public page. What should the analyst do first?

   • AAdd the URL to the policy's 'Blocked URLs' list.
   • BCreate a custom attack signature for the unusual User-Agent strings.
   • CInvestigate the source IPs and request patterns to determine if this is a targeted attack or a scanner.
   • DDisable the URL in the application to prevent access.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is reviewing entity data and finds that a specific cookie 'sessionID' is being sent with a value that is always the same for all users. The application team confirms that the cookie should be unique per user. What should the analyst do to address this issue?

   • AReport the issue to the application team to fix the cookie generation logic.
   • BConfigure ASM to enforce that the cookie value is unique per user.
   • CCreate a custom attack signature for the static cookie value.
   • DAdd the cookie to the 'Blocked Cookies' list.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When reviewing ASM data, an administrator combines attack signature matches, DataGuard events, parameter anomalies, and entity access patterns. What is the main benefit of this correlation?

   • AIt eliminates false positives by combining data
   • BIt provides a comprehensive view that helps identify complex attacks and evaluate policy effectiveness
   • CIt reduces the need for manual policy review by automating all decisions
   • DIt ensures that all attacks are blocked automatically
   Reveal Solution Discussion Select an answer first