1Y0-241 practice question 21 of 25

To protect an environment against Hash DoS attacks, which two configurations can a Citrix Administrator use to block all post requests that are larger than 10,000 bytes? (Choose two.)

Answer options

A: > add policy expression expr_hashdos_prevention “http.REQ.METHOD.EQ(\”POST\”)&& http.REQ.CONTENT_LENGTH.GT(10000)” > add rewrite policy drop_rewrite expr_hashdos_prevention DROP > bind rewrite global drop_rewrite 100 END –type REQ_OVERRIDE Correct answer

B: > add policy expression expr_hashdos_prevention “http.REQ.METHOD.EQ(\”POST\”)&& http.REQ.CONTENT_LENGTH.GT(10000)” > add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP > bind responder global pol_resp_hashdos_prevention 70 END –type REQ_OVERRIDE Correct answer

C: > add policy expression expr_hashdos_prevention “http.REQ.METHOD.EQ(\”POST\”) || http.REQ.CONTENT_LENGTH.GT(10000)” > add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP > bind responder global pol_resp_hashdos_prevention 70 END –type REQ_OVERRIDE

D: > add policy expression expr_hashdos_prevention “http.REQ.METHOD.EQ(\”POST\”) || http.REQ.CONTENT_LENGTH.GT(10000)” > add rewrite policy drop_rewrite expr_hashdos_prevention DROP > bind rewrite global drop_rewrite 70 END –type REQ_OVERRIDE

E: > add policy expression expr_hashdos_prevention “http.REQ.METHOD.EQ(\”POST\”) || http.REQ.CONTENT_LENGTH.GT(10000)” > add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP > bind responder global pol_resp_hashdos_prevention 100 END –type REQ_OVERRIDE

F: > add policy expression expr_hashdos_prevention “http.REQ.METHOD.EQ(\”POST\”) || http.REQ.CONTENT_LENGTH.GT(10000)” > add rewrite policy drop_rewrite expr_hashdos_prevention DROP > bind rewrite global drop_rewrite 100 END –type REQ_OVERRIDE

Correct Answer:

A. > add policy expression expr_hashdos_prevention “http.REQ.METHOD.EQ(\”POST\”)&& http.REQ.CONTENT_LENGTH.GT(10000)” > add rewrite policy drop_rewrite expr_hashdos_prevention DROP > bind rewrite global drop_rewrite 100 END –type REQ_OVERRIDE; B. > add policy expression expr_hashdos_prevention “http.REQ.METHOD.EQ(\”POST\”)&& http.REQ.CONTENT_LENGTH.GT(10000)” > add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP > bind responder global pol_resp_hashdos_prevention 70 END –type REQ_OVERRIDE

Explanation

The objective is to block requests that meet two specific criteria simultaneously: the request method must be 'POST' AND its content length must be greater than 10,000 bytes. This requires a policy expression that uses the logical AND operator (&&). Both Citrix ADC Responder and Rewrite policies support a DROP action, which silently discards the request. Options A and B correctly construct the policy expression using && and then apply a DROP action using a Rewrite policy (A) and a Responder policy (B), respectively. Both are valid and effective methods to achieve the desired protection against a potential Hash DoS attack.

Why Incorrect

C. This option uses the incorrect logical operator || (OR), which would block all POST requests regardless of size, or any request larger than 10,000 bytes, which is not the requirement.
D. This option uses the incorrect logical operator || (OR). The logic is flawed as it does not enforce both conditions simultaneously.
E. This option uses the incorrect logical operator || (OR), which would result in blocking traffic that does not meet the specified combined criteria.
F. This option uses the incorrect logical operator || (OR). The expression would incorrectly match requests that are only one of the two conditions, not both.

References

1. Citrix ADC 13.0 Product Documentation

"Operators in Policy Expressions": This document specifies the use of logical operators in policy expressions. It defines && as the logical AND operator

which "Evaluates to true if both of its operands are true." This supports the use of && to combine the conditions for the HTTP method and content length.

Source: Citrix ADC 13.0 Documentation > AppExpert > Policies and Expressions > Default Syntax > Operators in Policy Expressions.

2. Citrix ADC 13.0 Product Documentation

"Configuring a Responder Action": This official documentation lists DROP as a built-in responder action. It states

"The DROP action silently drops the user request without sending a response." This validates the method used in option B.

Source: Citrix ADC 13.0 Documentation > AppExpert > Responder > Configuring a Responder Action.

3. Citrix ADC 13.0 Product Documentation

"Configuring a Rewrite Action": This document confirms that DROP is a valid action for a rewrite policy. The description states: "DROP - Silently drops the connection. Can be used to filter unwanted requests." This validates the method used in option A.

Source: Citrix ADC 13.0 Documentation > AppExpert > Rewrite > Configuring a Rewrite Action.

4. Citrix ADC 13.0 Product Documentation

"Citrix ADC Default Syntax Policy Expressions Reference": This reference guide details the available expressions for policy configuration

including HTTP.REQ.METHOD to evaluate the HTTP request method and HTTP.REQ.CONTENTLENGTH to evaluate the size of the request body.

Source: Citrix ADC 13.0 Documentation > AppExpert > Policies and Expressions > Citrix ADC Default Syntax Policy Expressions Reference.

Keep practicing

Take the free 1Y0-241 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test