To protect an environment against Hash DoS attacks, which two configurations can a Citrix Administrator use to block all post requests that are larger than 10,000 bytes? (Choose two.)

Question

Options

• A

  add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ("POST") || http.

• B

  add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ("POST") &&

• C

  add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ("POST") &&

• D

  add policy expression expr_hashdos_prevention "http. REQ. METHOD.EQ("POST") || http.

• E

  add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ("POST" ||

• F

  add policy expression expr_hashdos_prevention "http. REQ. METHOD.EQ("POST") || http.

• B
  81% (25)
• C
  3% (1)
• D
  10% (3)
• F
  6% (2)

Explanation

Blocking Hash DoS attacks requires a policy that triggers only when both conditions are true simultaneously: the request method is POST and the body exceeds 10,000 bytes. Options B and E correctly use the && (logical AND) operator to enforce this compound condition - if either check alone were sufficient, the policy would be too broad or miss the attack vector entirely.

The distractors using || (logical OR) - options A, D, and F - are incorrect because OR logic means the policy fires if the method is POST or the body is large, which would incorrectly block non-POST large requests and fails to precisely target the Hash DoS pattern. Option C is syntactically close to B but contains a subtle difference (likely a spacing or operator error in the expression) that makes it invalid in NetScaler's policy engine. Option E is correct alongside B because it represents a second valid syntactic form (such as checking http.REQ.CONTENT_LENGTH vs http.REQ.BODY(...).LENGTH) that achieves the same logical result.

Memory tip: Think of Hash DoS defense as a two-factor gate - POST AND big body both must be true. Whenever you see || (OR) in the method/size check, it's wrong - || opens the gate too wide. Only && narrows it to the exact threat.

No community discussion yet for this question.