Objective 1.01 Explain How APM Mitigates Common Attack Vectors and Methodologies (e.g., Cookie Hijacking [front and Back], DoS Attack) 304 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A public-facing web portal is experiencing a surge of login attempts from a single IP address, overwhelming the backend authentication service. The administrator wants to use APM to limit the number of authentication requests from that source without affecting legitimate users. Which APM mechanism should be configured?

   • AConfigure a per-source-IP rate limit on the access policy.
   • BDisable the login page for the duration of the attack.
   • CSet a global session limit for the entire virtual server.
   • DEnable the access policy to require a client certificate for all users.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is experiencing a DoS attack that involves both a high volume of requests from a single IP and a distributed flood from many IPs. The administrator wants to use APM to mitigate both types of attacks without blocking legitimate users. Which combination of APM controls should be configured?

   • AConfigure only a global rate limit.
   • BConfigure a maximum concurrent session limit.
   • CConfigure only a per-source-IP rate limit.
   • DConfigure both a per-source-IP rate limit and a global rate limit.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's web application uses a session cookie that is set by the backend server. After a security review, the administrator wants to ensure that APM protects this cookie from being stolen by a malicious script running in the user's browser. Which APM configuration should be applied to the access policy?

   • AEnable the Secure and HttpOnly attributes on the session cookie via an APM profile.
   • BConfigure a per-request rate limit on the virtual server.
   • CSet the cookie to expire after a short idle timeout in the access policy.
   • DEnable the cookie encryption option in the APM profile.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the benefit of APM managing the cookie exchange between the client and the backend server?

   • AIt allows the backend to use a different session cookie for each client
   • BIt prevents the client from directly accessing the backend's session cookie
   • CIt ensures the backend server never sees the client's IP address
   • DIt eliminates the need for SSL/TLS between the client and APM
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of APM's resource management features, such as connection limits and session timeouts, in the context of DoS mitigation?

   • ATo encrypt all traffic between the client and the backend
   • BTo increase the speed of the backend servers
   • CTo provide a backup for the backend servers
   • DTo prevent a single user or attacker from exhausting system resources
   Reveal Solution Discussion Select an answer first