C2150-199 Exam Questions

Which statement is true about Privilege Escalation?

Where would you configure sequence variables?

The application you are testing contains links to external websites. You want to restrict the scan to the designated web application URL. Which configuration option should you use?

Which type of attack steals a user's session cookie after the user browses to a web forum?

What are two acceptable methods to protect sensitive user data?

What are the two main components of the Glass Box agent?

Which three settings can you configure with AppScan Tools Options Scan Options?

What is the simplest method of determining the coverage of a scan configuration, without running a full scan?

Why is it important to define error pages in IBM Security AppScan Standard Edition?

Why is it important that error pages are correctly defined?

What is the goal of a sidejacking web application attack?

Which tab contains the button to replicate a test?

The scan log shows "out of session" detection and the AppScan keeps failing to re-login to the application during the scan. Then you find the login account is locked out by the sys...

Which three finding types can the IBM Security AppScan Standard Edition malware module identify?

What are the two main functions of the Parameters and Cookie view?

Which statement is true about an IBM Security AppScan Standard Edition test policy?

Which log file would be useful in verifying whether or not a particular security test was executed during a test?

A user has recorded a login. AppScan is still reporting an out-of-session error during testing. What should the user check to correct the issue?

Which two login methods allows you to create a login sequence?

In the Login Management view, what does the following icon indicate?

Which statement is true about URL settings in Automatic Form Fill?

What is HTTP Authentication?

What is Multiphase Scanning?

Where can you configure Multi-Step Operations?

Which situation presents a valid reason for reducing the severity ofvulnerability?

An application server stops responding when you run AppScan scan against it but appears to work normally when you manually browse the site after the scan stops. What should you do...

In the Redundancy tuning of Parameters and Cookies view, the following option is disabled, - Explore the URL again whenever this parameter/cookie is added or removed.

You are reviewing scan results and find that for several pages your site returned 5xx Server Error response in a form of custom error page. As a result, several False Positive find...

Which three report templates are available in a Security Report?

In the Automatic Form Fill window, if the URL field is blank for a particular row, which value will be passed for that row's parameter?

Test_domain2.com is included in the additional servers and domains in this scan. What would happen in this situation?

Which type of attack relies on an authenticated user to click a malicious link to perform an unintended action on the target application?

What are three parts of the Explore Options view?

Upon reviewing the URLs that IBM Security AppScan Standard Edition discovered during an automatic explore, you find that the registration success page was not discovered while the...

How do you remove sensitive information from the scan logs?

How can IBM Security AppScan Standard Edition automatically create a navigation structure?

An application you have been tasked with testing uses JavaScript or Java applets that reveal certain parts of the application only when states (such as Hover and Mouse Over) follow...

Do you need to install a license server for IBM Security AppScan Standard Edition V8.7?

Given the following: Security Issues Which type of report is this an example of?

A website consist of several systems and they are separated by directories as follows: How do you setup the Appscan to avoid scanning system2 except the "project" folder under it?

Which two types of reports allow a user to import a custom .asreg file to specify a user- defined template?

What is the purpose of the Automatic Form Fill in the scan configuration?

Which three environment definitions are options in Scan Configuration?

Which login method does NOT support in-session detection?

Which framework does IBM Security AppScan Standard Edition require to be installed?

You just updated the error page for the application. When will that update affect the scan results?

Where would you configure AppScan to identify itself, and the exact stage of the scan, in each HTTP request?

An AppScan user captured the following URLs during a recorded login: The same user selected an in-session detection pattern of "Hello John Smith". Given that the "Hello John Smith"...

Which three reports layout options are available?

What information is available when a vulnerability is discovered via traditional dynamic testing (i.e. not via Glassbox testing or JavaScript analysis)?