Objective 1.02 Identify Which APM Tool(s) Should Be Used to Mitigate a Specific Authentication Attack 304 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which BIG-IP APM tool would be most appropriate to mitigate session hijacking by ensuring that session tokens are invalidated after a period of inactivity?

   • AAccess policy
   • BClient certificate authentication
   • CSession management
   • DBrute force protection
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A BIG-IP APM administrator is configuring a new access policy for a web application. The administrator wants to ensure that if a user closes the browser and reopens it, the user does not have to re-authenticate for a period of 8 hours. Which APM setting should be configured to achieve this?

   • ASet the session idle timeout to 8 hours.
   • BSet the session cookie to be persistent with a lifetime of 8 hours.
   • CConfigure the access policy to use a session variable instead of a cookie.
   • DEnable the 'Secure' flag on the session cookie.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A BIG-IP APM administrator is configuring an access policy for a web application. The administrator wants to ensure that the session cookie is not accessible to client-side scripts, to mitigate the risk of cross-site scripting (XSS) attacks stealing the cookie. Which cookie attribute should be enabled?

   • ASet the session cookie to be persistent.
   • BEnable the 'HttpOnly' flag on the session cookie.
   • CIncrease the session idle timeout.
   • DEnable the 'Secure' flag on the session cookie.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's BIG-IP APM is currently using a forms-based authentication method for its remote access portal. The security team has noticed a high volume of failed login attempts coming from a small set of IP addresses, each targeting a single user account with a list of common passwords. The company wants to block these attempts without affecting legitimate users who occasionally mistype their password. Which APM feature should be configured to address this specific attack?

   • AEnable client certificate authentication on the access policy.
   • BConfigure a brute force protection profile and apply it to the virtual server.
   • CSet the access policy to use a one-time password (OTP) for all users.
   • DImplement a session management profile to limit concurrent sessions per user.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A BIG-IP APM administrator is troubleshooting an issue where users are frequently being prompted to re-authenticate when accessing a web application. The administrator suspects that the session cookie is being deleted by the browser when it is closed. Which APM setting should be adjusted to ensure the session persists across browser restarts?

   • ASet the session cookie's 'Secure' flag.
   • BEnable the 'HttpOnly' flag on the session cookie.
   • CConfigure the session cookie to be a persistent cookie with a defined lifetime.
   • DIncrease the session idle timeout in the access policy.
   Reveal Solution Discussion Select an answer first