Objective 2.03 Review and Evaluate Rules Based on Information Gathered from ASM (e.g., Attack Signatures, DataGuard, Parameters, Entities) 303 Practice Questions (Page 4)

Questions 16–17

1. 16application · medium

   An analyst is reviewing DataGuard events and finds that a web application is returning social security numbers (SSNs) in error messages. The application team says this is a bug and they will fix it in the next release, which is two weeks away. The compliance team requires that SSNs not be exposed. What should the analyst do to mitigate the risk immediately?

   • AConfigure DataGuard to block responses containing SSNs.
   • BWait for the application fix and continue to monitor the DataGuard events.
   • CDisable DataGuard for the application to avoid false positives.
   • DCreate a DataGuard exception for the error messages.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is reviewing ASM logs and finds that a parameter 'file' is triggering 'Command Injection' signature matches. The requests are using a legitimate file name, but with a trailing semicolon and a command. The application team confirms that the 'file' parameter should only accept alphanumeric file names. The policy is in 'Blocking' mode. What should the analyst do to prevent these attacks?

   • ADefine the 'file' parameter as 'Alphanumeric' in the policy.
   • BAdd the 'file' parameter to the 'Blocked Parameters' list.
   • CDisable the 'Command Injection' signature set for the 'file' parameter.
   • DCreate a custom attack signature for the specific command injection payloads.
   Reveal Solution Discussion Select an answer first