Objective 1.02 Identify Which APM Tool(s) Should Be Used to Mitigate a Specific Authentication Attack 304 Practice Questions (Page 4)

Questions 16–19

1. 16expert · hard

   A company is using BIG-IP APM to protect a web application that is accessed by both internal employees and external contractors. The security team has discovered that a contractor's credentials were used to access the application from an unknown IP address. The team suspects that the contractor's password was phished. Which APM feature should be implemented to prevent this type of attack in the future?

   • AUse a client certificate authentication method for contractors.
   • BConfigure a brute force protection profile to limit login attempts.
   • CEnforce multi-factor authentication (MFA) for all users.
   • DImplement a session management profile to limit concurrent sessions.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is deploying a new BIG-IP APM portal for external partners. The security policy requires that authentication be resistant to credential stuffing attacks, where attackers use username/password pairs leaked from other sites. The company also wants to avoid the operational overhead of issuing hardware tokens to partners. Which combination of APM features best meets these requirements?

   • AConfigure a client certificate authentication method for all partners.
   • BImplement a multi-factor authentication (MFA) method using a software-based OTP.
   • CUse a basic authentication method with a strong password policy.
   • DEnable brute force protection with a low threshold for failed attempts.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization uses BIG-IP APM to protect a web application. They have observed that after a user successfully authenticates, an attacker is able to hijack the user's session by stealing the session cookie. The stolen cookie is being used from a different IP address. Which APM configuration would be most effective in mitigating this specific attack?

   • ASet the session idle timeout to a very short duration.
   • BConfigure the access policy to terminate sessions if the client IP address changes.
   • CEnable the 'Single Sign-On' (SSO) feature to reduce the number of times credentials are entered.
   • DImplement a brute force protection profile to limit login attempts.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which authentication method is most appropriate for a public web application where users are not technical and the application needs to integrate with a custom login page?

   • AForms-based authentication
   • BBasic authentication
   • CMultifactor authentication
   • DClient-certificate authentication
   Reveal Solution Discussion Select an answer first