C2150-199 Exam Questions

Which authentication method is supported when IBM Security Authentication Tester PowerTool uses the "brute-force" technique to reveal weak username-password combinations that could...

You need a template-based report of all the issue ID and variants found by a scan. How should you create this?

Which two categories of Match Types can be used when specifying Automatic Form Fill values?

Which three statements are true about configuring an IBM Security AppScan Standard Edition test policy?

Which type of vulnerability can occur when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or for...

After 30 minutes your scan stops with an out-of-session error. What is a possible cause of this error?

What information does difference displayed in the Request / Response tab provide?

You are scanning a Web site in a pre-production environment. You notice that your scan is running very slowly and there are numerous communication errors. What would you do to reso...

Which type of vulnerability allows an attacker to execute a malicious script in a user browser?

Which statement is true about infrastructure vulnerabilities?

What does secure session management require?

You are scanning a Web application in a pre-production environment. During your initial assessment, you notice that some of the links are specified by IP and some by host name. com...

You expect your scan to cover around 500 pages, but instead it covers 55. What are three possible reasons for this? (Choose three.)

How does in-session detection work?

Which three steps should you take before running a security scan with AppScan? (Choose three.)

Which statement is true about network firewalls preventing Web application attacks?

Which username/passwords combination would NOT be reported as predictable by AppScan?

When would you set up a multi-step operation in AppScan?

What does a Cross-site Scripting vulnerability allow an attacker to do?

AppScan belongs to which category of vulnerability assessment tools?

What are two reasons why it is recommended that a Web application be scanned in a preproduction environment? (Choose two.)

What is indicative of Information Leakage vulnerability?

In the AppScan Application Data view, what can help you determine if your application was fully explored? (Choose two.)

Which statement is true about application-specific vulnerabilities?

What are the implications of Malicious File Execution vulnerabilities?

Where can you find details about a test AppScan executed during a scan?

Which HTTP response codes trigger Application Error vulnerabilities?

AppScanreported a large number of idden files, which you know do not exist on your Web server. What is the likely cause?

How does an attacker exploit Web application vulnerabilities?

Which AppScan report type relates to Sarbanes-Oxley Act, HIPPA and FISMA?

How can an attacker use the information gained by an SQL debug message?

Which type of parameters does AppScan manipulate when testing a .Net Web Service

After scanning your site with AppScan, you notice that your password was changed to 234. What most likely happened?

Which defense is most reliable in protecting a Web application from being hacked?

Directories containing sensitive files must be hidden from the user. What is the best way to hide the existence and content of such a directory?

Why is it important to encrypt the HTTP traffic for an authenticated connection between a client and Web server?

You notice that when you run your scan, your login account gets locked out. How can you resolve the issue?

What information does reasoning displayed in the Request / Response tab provide?

How does AppScan test a Web application?

What happens when AppScan generates an Industry Standard report?

Which three actions should you take if your application requires form-based authentication? (Choose three.)

How do you test a Web service with AppScan?

In which three areas does AppScan test for vulnerabilities?

Which lines in an HTTP response would trigger a positive result from an AppScan test for a vulnerability of type Possible Server Path Disclosure Pattern Found?

Which Web application operation indicates that the application may be vulnerable to Cross-site Request Forgery?

When can an injection type attack occur?

Which type of vulnerability allows an attacker to browse files that shouldn be accessible (e.g. *.bak, "Copy of", *.inc, etc.) or pages restricted forWhich type of vulnerability al...

What is the problem with the following session pattern? Good morning, John!

Your site contains the following URL: In this URL, the Page parameter defines a unique page. How would you configure AppScan to fully explore this site?

To construct a test, AppScan changed an HTTP request by removing the File CFileand First_name parameters and changing the value of the Email_address mail_address parameter to "><sc...