Objective 1.01 Explain How APM Mitigates Common Attack Vectors and Methodologies (e.g., Cookie Hijacking [front and Back], DoS Attack) 304 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which BIG-IP APM capability directly helps mitigate the risk of session cookie theft by an attacker who intercepts client traffic?

   • AUsing a firewall rule to block all HTTP traffic
   • BStoring session cookies only on the backend server
   • CDisabling cookies entirely in the APM policy
   • DEncrypting session cookies using SSL/TLS between the client and APM
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of APM encrypting the session cookie that is sent to the client's browser?

   • ATo allow the backend server to read the cookie without decryption
   • BTo ensure the cookie is stored only in memory, not on disk
   • CTo prevent an attacker from reading or modifying the cookie contents
   • DTo reduce the size of the cookie for faster transmission
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization runs a legacy web application that sets a session cookie with a predictable value. The security team wants APM to prevent an attacker from guessing or replaying this cookie to gain unauthorized access. Which APM feature should be used?

   • AConfigure APM to generate and manage a separate, secure session cookie that is mapped to the backend cookie.
   • BApply a strict transport security header to the response.
   • CSet the backend cookie to expire after 5 minutes.
   • DEnable the HTTP/2 protocol on the virtual server.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application is being flooded with HTTP requests from many different IP addresses, overwhelming the backend. The administrator wants APM to limit the rate of requests globally to protect the backend. Which APM configuration should be applied?

   • AEnable the HttpOnly attribute on the session cookie.
   • BConfigure a global rate limit on the access policy.
   • CConfigure a per-source-IP rate limit.
   • DSet a maximum concurrent session limit.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A web application uses a backend cookie that contains sensitive user information in plaintext. The security team wants to ensure that the client never sees the raw backend cookie value. Which APM approach should be used?

   • AUse APM to replace the backend cookie with an opaque session identifier.
   • BEnable the HttpOnly attribute on the backend cookie.
   • CSet the backend cookie to expire after a short period.
   • DEncrypt the backend cookie with a custom iRule.
   Reveal Solution Discussion Select an answer first