Objective 2.03 Review and Evaluate Rules Based on Information Gathered from ASM (e.g., Attack Signatures, DataGuard, Parameters, Entities) 303 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An analyst is reviewing ASM logs and notices that a parameter named 'id' is triggering 'SQL Injection' signature matches, but the requests are not being blocked. The policy is in 'Blocking' mode. The analyst checks the parameter definition and finds that 'id' is defined as a 'Static Content' parameter. What is the most likely reason the requests are not being blocked?

   • AThe 'Block' action is not enabled for the SQL Injection signature set.
   • BThe requests are not matching the signature because the payload is encoded.
   • CThe parameter is not in the 'Learning' stage, so it is not being enforced.
   • DThe 'Static Content' parameter type is not evaluated for attack signatures.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   While analyzing ASM logs, an administrator notices that a parameter named 'userID' is receiving unexpected values in many requests. What is the primary purpose of analyzing this parameter data?

   • ATo change the parameter name to something more secure
   • BTo delete the parameter from the policy to prevent attacks
   • CTo identify anomalies or attacks targeting that parameter and assess the policy's effectiveness
   • DTo increase the logging level for that parameter
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is reviewing attack signature matches and finds that a specific signature 'XSS - Script Tag' is triggering frequently on a search page. The requests are using a parameter 'q' that contains the string '<script>alert(1)</script>'. The application team confirms that the search page does not render HTML. What should the analyst do to reduce false positives?

   • AReview the application's behavior to confirm it does not render HTML, then create a signature exception for the specific URL and parameter.
   • BAdd the search page URL to the 'Trusted URLs' list.
   • CCreate a parameter exception for 'q' to allow the script tag.
   • DDisable the 'XSS - Script Tag' signature for the entire policy.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An ASM log shows that a parameter 'price' is being submitted with values that do not match the expected format. What should the administrator do when reviewing this parameter data?

   • AIgnore the log entries because parameter values are not important
   • BImmediately block all requests that contain the 'price' parameter
   • CEvaluate the requests to determine if the values indicate an attack and then adjust the parameter's validation rules if needed
   • DChange the parameter type to 'string' to accept any value
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   While reviewing ASM logs, an administrator sees a pattern of requests to a specific URL that is not part of the application's normal structure. What is the primary purpose of reviewing this entity data?

   • ATo rename the URL to match the application's structure
   • BTo ignore the URL because entity data is not useful for policy review
   • CTo add the URL to a blocklist to prevent all future access
   • DTo understand attack patterns and assess whether the policy is effectively covering the application's entities
   Reveal Solution Discussion Select an answer first