1Y0-342 Sample Questions & Answers
Implementing core WAF protections against top-level and URL-based threats is the single biggest topic, alongside rate limiting and IP reputation, bot and API defenses, SAML single sign-on through AAA and nFactor, NetScaler Console management, and performance tuning.
Launch the full 1Y0-342 simulator →Showing 8 of 17 free samples.
- Question 1Beginner
NetScaler Web App Firewall Profiles and Policies · WAF Profiles
When configuring a new NetScaler WAF deployment for a modern web application, the security team notices that the application uses heavily customized JSON payloads for API communications. To properly inspect these payloads, which type of WAF profile must the team utilize?
Show answer & explanation
Correct answer: C
NetScaler WAF requires an Advanced Profile to inspect specific payload types such as XML, HTML, and JSON. Basic profiles do not support the deep parsing and schema validation required for specialized JSON API communications. The Advanced profile unlocks the necessary security checks for REST APIs and JSON payload validation.
- Question 2Intermediate
NetScaler Web App Firewall Profiles and Policies · WAF Policies
During a security audit, an engineer discovers that a specific WAF policy designed to protect an e-commerce virtual server is not being evaluated. The policy is bound directly to the load balancing virtual server with a priority of 100. However, a global WAF policy with a priority of 50 is also active. Why is the virtual server policy being bypassed?
Show answer & explanation
Correct answer: A
In NetScaler policy evaluation, the priority number dictates the order of execution. Lower priority numbers are evaluated first. Because the global policy has a priority of 50 and the virtual server policy has a priority of 100, the global policy is evaluated first. If the global policy expression matches the traffic, the NetScaler applies its associated profile and stops evaluating further policies, thereby bypassing the virtual server policy.
- Question 3AdvancedSelect 2
NetScaler Web App Firewall Profiles and Policies · WAF Learning
The NetScaler WAF adaptive learning engine is configured to observe traffic and recommend relaxation rules for a newly deployed web application. Which TWO of the following conditions must be met for the learning engine to generate a relaxation rule recommendation? (Select TWO)
Show answer & explanation
Correct answers: B, D
For the WAF learning engine to generate relaxation rules, the 'Learn' action must be explicitly checked/enabled for the corresponding security check within the WAF profile. Additionally, the observed traffic must cross the configured minimum learning threshold (number of hits) before a recommendation is surfaced to the administrator.
For the WAF learning engine to generate relaxation rules, the 'Learn' action must be explicitly checked/enabled for the corresponding security check within the WAF profile. Additionally, the observed traffic must cross the configured minimum learning threshold (number of hits) before a recommendation is surfaced to the administrator.
- Question 4Intermediate
NetScaler Web App Firewall Profiles and Policies · Signatures and Comment Stripping
To minimize false positives while deploying updated WAF signatures, a security administrator wants to observe the impact of new Snort rules without blocking legitimate user traffic. Which configuration approach provides the safest method to achieve this goal?
Show answer & explanation
Correct answer: C
The safest deployment method for new signatures is to run them in a transparent or monitoring mode. By enabling 'Log' and 'Stats' while leaving 'Block' unchecked, the WAF will identify and record matching traffic without dropping the connections. This allows administrators to review the logs for false positives before actively enforcing the block action.
- Question 5Intermediate
NetScaler Web App Firewall Profiles and Policies · Logging and Reporting
A compliance mandate requires all WAF violation logs to be sent to a central SIEM using a standardized format that natively includes key-value pairs for easy ingestion by third-party analytics tools. Which NetScaler logging format should the administrator configure?
Show answer & explanation
Correct answer: B
The Common Event Format (CEF) is an open log management standard that improves the interoperability of security-related information. NetScaler WAF supports CEF logging, which formats log messages using standardized key-value pairs, making it highly efficient for SIEM solutions (like Splunk or ArcSight) to parse and analyze WAF violation data.
- Question 6Beginner
Implementing Protections · Security Checks and Data Flow
True or False: In the NetScaler WAF processing pipeline, response-side checks such as Safe Object and Credit Card masking are evaluated before request-side checks like SQL Injection and Start URL.
Show answer & explanation
Correct answer: B
This statement is False. In the NetScaler WAF data flow, request-side checks (like SQLi, XSS, Start URL) are processed first when the client request arrives at the ADC. Only if the request passes these checks is it forwarded to the backend server. When the server responds, response-side checks (like Safe Object and Credit Card masking) are then evaluated before sending the data back to the client.
flowchart LR Client -->|1. Request| ReqCheck[Request Checks: SQLi, XSS] ReqCheck -->|2. Valid| Server Server -->|3. Response| RspCheck[Response Checks: Safe Object] RspCheck -->|4. Clean/Masked| Client - Question 7Intermediate
Implementing Protections · URL Protections
A web application has a strict workflow where users must always begin at
/login.phpor/index.php. However, the security team notices that attackers are bypassing the intended sequence by directly accessing deep-linked administrative pages like/admin/config.php. Which WAF security check should be configured to prevent this behavior?Show answer & explanation
Correct answer: C
The Start URL check ensures that users enter the application through designated entry points (like login or index pages) and prevents them from bookmarking or directly accessing deep-linked internal pages (forceful browsing). Combined with URL closure, it strictly enforces the application's intended navigational workflow.
- Question 8Advanced
Implementing Protections · Top-Level Protections
A critical customer-facing portal frequently requires users to submit text containing mathematical symbols (like
SELECTandUPDATE) as part of legitimate technical support tickets.The security administrator enabled the SQL Injection and Cross-Site Scripting (XSS) checks with the 'Block' action enabled. Immediately, users began complaining that they could no longer submit support tickets, resulting in a spike of false positives.
Which configuration adjustment will allow the WAF to neutralize the malicious elements without outright blocking the legitimate support ticket submissions?
Show answer & explanation
Correct answer: C
The 'Transform' action modifies offending characters to render them harmless while allowing the rest of the request to pass through to the backend. For XSS, it converts tags like
<to HTML entities (e.g.,<). For SQLi, it neutralizes SQL keywords or special characters. This eliminates the false positives caused by blocking, while still neutralizing the potential threat in the support ticket text.
Ready for the real thing?
The full 1Y0-342 simulator has every exam-style question, timed mode, and instant scoring.