2.01 Determine the Correct Solution to Mitigate a Given Threat 401 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An attacker sends a crafted HTTP request that exploits a vulnerability in a web application's input validation to execute arbitrary commands on the server. How should this threat be categorized?

   • ANetwork intrusion
   • BDistributed denial-of-service (DDoS) attack
   • CBrute-force attack
   • DApplication-layer attack
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A team has configured a network firewall to block certain IP addresses. What is the primary purpose of running a simulation with known attack patterns before going live?

   • ATo test the firewall's physical hardware durability
   • BTo reduce the number of firewall rules
   • CTo increase the firewall's processing speed
   • DTo verify that the firewall effectively blocks the intended traffic
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is deploying a new BIG-IP ASM solution to protect a critical application. The security team wants to ensure that the WAF does not introduce latency that would violate the application's performance SLA. They plan to test the solution in a staging environment. Which testing approach should be used to validate performance?

   • ADeploy the WAF in production and monitor performance during peak hours
   • BUse a load testing tool to generate realistic traffic and measure response times with the WAF enabled and disabled
   • CReview the WAF's default performance settings and assume they are optimized
   • DEnable the WAF in blocking mode and monitor the application logs for errors
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization is deploying a new patient portal that will handle sensitive personal health information. The security team requires protection against SQL injection and cross-site scripting attacks, while also needing to ensure that the application remains available during a targeted DDoS attack. The portal is fronted by BIG-IP LTM for load balancing. Which combination of F5 solutions should be implemented?

   • AEnable the ASM module on the existing LTM virtual server and add AFM with DoS protection profiles
   • BDeploy AFM with a strict security policy that blocks all traffic not originating from the internal network
   • CUse LTM's built-in iRules to inspect HTTP requests for SQL injection and XSS patterns
   • DConfigure ASM to rate-limit all incoming requests to 100 requests per second per IP address
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security administrator has configured BIG-IP ASM to protect a web application from SQL injection attacks. Before deploying the configuration to production, the administrator wants to validate that the WAF policy does not block legitimate user traffic. Which testing method should be used?

   • ADeploy the WAF policy in transparent mode and monitor for false positives
   • BRun a penetration test against the production application with the WAF in blocking mode
   • CUse the ASM learning suggestion feature to automatically block all traffic that matches attack signatures
   • DReview the ASM security logs from the production environment to identify past attacks
   Reveal Solution Discussion Select an answer first