Objective 1.01 Explain How APM Mitigates Common Attack Vectors and Methodologies (e.g., Cookie Hijacking [front and Back], DoS Attack) 304 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which APM policy action helps prevent an attacker from reusing a stolen session cookie after the legitimate user has logged out?

   • ACookie encryption
   • BSSL/TLS inspection
   • CSession termination on logout
   • DAccess policy logging
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A web application allows users to log in and maintains a session cookie. The security team wants to ensure that the session cookie cannot be accessed by JavaScript and is only sent over HTTPS. Which APM configuration should be applied to the access policy?

   • ASet both the HttpOnly and Secure attributes on the session cookie.
   • BSet a short session timeout and enable the SameSite attribute.
   • CSet only the HttpOnly attribute on the session cookie.
   • DSet only the Secure attribute on the session cookie.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An organization wants to use BIG-IP APM to reduce the risk of denial-of-service attacks against its web application. Which APM feature is specifically designed to limit the number of concurrent user sessions?

   • ASession limits
   • BSSL offloading
   • CCookie encryption
   • DAccess policy logging
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A web application uses a session cookie that is vulnerable to both front-end and back-end hijacking. The front-end risk is XSS theft, and the back-end risk is that the cookie value is predictable. The administrator wants to use APM to mitigate both risks. Which APM approach is most effective?

   • AConfigure APM to generate a new, random session cookie with the HttpOnly attribute and map it to the backend cookie.
   • BConfigure a short session timeout for the existing cookie.
   • CSet the HttpOnly attribute on the existing backend cookie.
   • DEnable the Secure attribute on the existing backend cookie.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A web application is suffering from a slowloris attack, where many connections are opened but not completed, tying up server resources. The administrator wants APM to mitigate this type of DoS. Which APM feature is most appropriate?

   • ADisable HTTP keep-alive on the virtual server.
   • BEnable the HttpOnly attribute on the session cookie.
   • CSet a maximum concurrent session limit.
   • DConfigure a connection timeout and rate limit on the virtual server.
   Reveal Solution Discussion Select an answer first