Objective 2.03 Review and Evaluate Rules Based on Information Gathered from ASM (e.g., Attack Signatures, DataGuard, Parameters, Entities) 303 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is reviewing entity data and finds that a specific header 'X-Forwarded-For' is being sent with a value that is not a valid IP address. The requests are coming from a load balancer that should set this header. What should the analyst do?

   • ACreate a custom attack signature for the invalid header value.
   • BInvestigate the load balancer configuration to ensure it is setting the header correctly.
   • CBlock requests with an invalid 'X-Forwarded-For' header.
   • DDisable the 'X-Forwarded-For' header check in the policy.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An ASM log shows a DataGuard event for a social security number pattern. What is the most appropriate action for the administrator to take based on this finding?

   • ADelete the log entry to remove evidence of the exposure
   • BReview the request and response to understand how the data was exposed and then adjust DataGuard settings if necessary
   • CChange the DataGuard pattern to a less specific pattern to reduce false positives
   • DIgnore the event because DataGuard is only for credit card numbers
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   While reviewing ASM logs, an administrator finds DataGuard events indicating that a credit card number was sent in a request. What is the primary purpose of reviewing this DataGuard finding?

   • ATo block the user who sent the credit card number
   • BTo identify the credit card number and store it for fraud analysis
   • CTo determine if sensitive data is being exposed and adjust DataGuard settings to prevent future exposure
   • DTo verify that the credit card number is valid
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An ASM log shows a high number of requests with an unusual cookie value. What should the administrator do when reviewing this entity data?

   • AIncrease the logging level for cookies to get more data
   • BIgnore the cookie because cookies are not important entities
   • CDelete the cookie from the policy to prevent attacks
   • DAnalyze the cookie values to determine if they indicate an attack and then adjust the policy's cookie handling if necessary
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An administrator is reviewing ASM logs and notices that a specific URL is receiving requests that match an attack signature, contain a suspicious parameter, and include a DataGuard event. What is the primary purpose of correlating this information?

   • ATo create a single log entry that combines all the data for easier storage
   • BTo automatically block the URL based on the combined data
   • CTo delete the individual log entries to reduce noise
   • DTo gain a comprehensive understanding of the attack and make informed policy review and customization decisions
   Reveal Solution Discussion Select an answer first