Objective 1.01 Explain How APM Mitigates Common Attack Vectors and Methodologies (e.g., Cookie Hijacking [front and Back], DoS Attack) 304 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does BIG-IP APM mitigate back-end cookie hijacking when a backend server sets a session cookie?

   • ABy blocking all cookies from the backend server
   • BBy storing the backend cookie only on the APM itself
   • CBy encrypting and rewriting the cookie before it is sent to the client
   • DBy using a different domain for the backend cookie
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security auditor reports that the session cookie for a web application is being transmitted over an unencrypted HTTP connection, making it vulnerable to interception. The administrator wants APM to enforce that the cookie is only sent over HTTPS. Which APM setting should be enabled?

   • AEnable the Secure attribute on the session cookie.
   • BEnable the SameSite attribute on the session cookie.
   • CConfigure a short session timeout in the access policy.
   • DEnable the HttpOnly attribute on the session cookie.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security audit reveals that an attacker can use a cross-site scripting (XSS) vulnerability to steal a user's session cookie and then replay it to access the user's account. The administrator wants to use APM to prevent this attack. Which APM configuration is most effective?

   • AEnable the SameSite attribute on the session cookie.
   • BSet the HttpOnly attribute on the session cookie.
   • CEnable the Secure attribute on the session cookie.
   • DConfigure a short session timeout.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company wants to protect its web application from both DoS attacks and session hijacking. The administrator has limited resources and must choose a single APM configuration that provides the broadest protection. Which configuration should be chosen?

   • AConfigure only the HttpOnly attribute on session cookies.
   • BConfigure only rate limiting.
   • CConfigure only a maximum concurrent session limit.
   • DConfigure rate limiting and session limits, and set the HttpOnly attribute on session cookies.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which APM feature can be used to limit the rate of authentication attempts from a single source IP address?

   • ASSL offloading
   • BAccess policy logging
   • CRate limiting
   • DSession cookie encryption
   Reveal Solution Discussion Select an answer first