Objective 1.03 Explain How APM Uses and Manages Session Cookies (domain, Host, Multi-Domain) 304 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization requires that users access a patient portal only from devices that have a specific security software installed and running. The APM administrator needs to enforce this requirement before the user is authenticated. Which APM feature should be used to check for the security software?

   • AEndpoint inspection using OPSWAT.
   • BMulti-domain cookie handling.
   • CSession cookie domain configuration.
   • DPassword guessing mitigation.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has two web applications: app1.example.com and app2.example.com. Both are protected by the same APM access policy and share a session cookie with a domain of .example.com. The security team wants to ensure that a user authenticated on app1 cannot access app2 without going through the access policy again. However, the business wants single sign-on across both applications. Which configuration best meets both requirements?

   • AKeep the shared .example.com cookie and rely on the access policy to re-evaluate authorization for app2.
   • BUse a host-only cookie for app1 and a domain cookie for app2.
   • CSet the cookie domain to .example.com and disable the access policy for app2.
   • DUse separate cookies for each application with different domains.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How does APM handle session cookies when a user accesses multiple domains that are all protected by the same APM policy?

   • AAPM uses the same cookie for all domains by setting the Domain attribute to '*'
   • BAPM sets a single cookie with a Domain attribute covering all protected domains
   • CAPM sets a separate session cookie for each domain, each tied to that domain's scope
   • DAPM stores the session in a cookie that is sent to every domain the user visits
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has an APM-protected web application and wants to ensure that only devices with a specific security certificate installed can access the application. The administrator needs to enforce this requirement before the user is authenticated. Which APM feature should be used to check for the certificate?

   • APassword guessing mitigation.
   • BSession cookie domain configuration.
   • CMulti-domain cookie handling.
   • DEndpoint inspection using a certificate check.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An organization has an APM-protected web application and has been experiencing brute-force login attempts. The security team wants to lock out an account after 5 failed password attempts within 10 minutes, and then require a 15-minute lockout period. Which APM feature should the administrator configure to meet this requirement?

   • AEnable endpoint inspection to block clients with repeated failed attempts.
   • BConfigure a multi-domain cookie to limit login attempts across domains.
   • CSet the session cookie timeout to 10 minutes and the idle timeout to 15 minutes.
   • DConfigure the password guessing mitigation settings in the access policy.
   Reveal Solution Discussion Select an answer first