Objective 1.03 Explain How APM Uses and Manages Session Cookies (domain, Host, Multi-Domain) 304 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of the session cookie that APM sets after a user successfully authenticates?

   • ATo cache the user's group memberships locally on the client to reduce server load
   • BTo store the user's password in encrypted form for automatic re-authentication
   • CTo encrypt all application traffic between the client and the backend server
   • DTo maintain the user's authentication state across subsequent HTTP requests without requiring repeated logins
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company requires that users access an internal web application only from corporate-managed Windows devices that have the latest antivirus definitions and a specific registry key set. The APM administrator is building an access policy. Which combination of APM features should be used to enforce this requirement?

   • AA password guessing mitigation policy and a session cookie with a short timeout.
   • BEndpoint inspection with OPSWAT and a registry check, followed by session cookie issuance.
   • CA client-side JavaScript check for the registry key and a session cookie.
   • DA multi-domain cookie configuration and a host-only cookie attribute.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In an APM policy, where does endpoint inspection typically occur relative to user authentication?

   • AAfter authentication, as part of the access decision process
   • BBefore authentication, to ensure the device is compliant before prompting for credentials
   • COnly when the user requests a specific application
   • DIt is not part of the APM policy; it is done by the backend server
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company runs two separate web applications on different domains: portal.contoso.com and shop.fabrikam.com. Users must authenticate once and access both applications without being prompted again. The APM administrator is configuring session cookie handling. What should the administrator do to achieve single sign-on across these two different domains?

   • ASet the cookie domain to .com so both domains share the cookie.
   • BConfigure a federated SSO solution that issues a shared token, and have APM validate it for both domains.
   • CSet the cookie path to /shared so both applications receive the same cookie.
   • DUse a separate APM access policy for each domain and rely on the browser to send both cookies.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which mechanism does APM use to mitigate password guessing attacks by limiting the number of failed attempts?

   • AIncreasing the password complexity requirement for each failed attempt
   • BDisabling the user's browser cookies after a failed attempt
   • CRedirecting the user to a different authentication server after each failure
   • DAccount lockout after a configured number of failed attempts
   Reveal Solution Discussion Select an answer first