Which configuration uses a policy expression to block POST requests with a content length greater than 10000 bytes using a REQ_OVERRIDE action?

Which configuration uses a policy expression to block POST requests with a content length greater than 10000 bytes using a REQ_OVERRIDE action?

• A. add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ(\"POST\") && http.REQ.CONTENT_LENGTH.GT(10000)" add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP bind responder global pol_resp_hashdos_prevention 70 END -type REQ_OVERRIDE
• B. add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ(\"POST\") && http.REQ.CONTENT_LENGTH.GT(10000)" add rewrite policy drop_rewrite expr_hashdos_prevention DROP bind rewrite global drop_rewrite 100 END -type REQ_OVERRIDE
• C. add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ(\"POST\") || http.REQ.CONTENT_LENGTH.GT(10000)" add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP bind responder globa
• D. add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ(\"GET\") && http.REQ.CONTENT_LENGTH.GT(10000)" add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP bind responder global pol_resp_hashdos_prevention 100 END -type REQ_OVERRIDE

Answer: (A)

Block at the request level by combining precise request characteristics into a single policy expression and then enforcing a drop when those characteristics are met. Here, the expression checks two things: the HTTP method must be POST and the request’s content length must be greater than 10,000 bytes. Using a responder policy with the DROP action means any matching request is rejected right away, rather than being forwarded. Binding this policy globally with the REQ_OVERRIDE type ensures this decision overrides normal processing for all traffic that meets the criteria, applying the rule consistently across the entire deployment. This is the right approach because it targets exactly the scenario: large POST requests. The other options don’t fit as well: using OR would trigger on either condition, not on both; targeting GET misses the requirement; and binding a rewrite policy (even with REQ_OVERRIDE) is not the same as blocking at the responder/request stage, which is what a DROP in a responder policy achieves.

Block at the request level by combining precise request characteristics into a single policy expression and then enforcing a drop when those characteristics are met. Here, the expression checks two things: the HTTP method must be POST and the request’s content length must be greater than 10,000 bytes. Using a responder policy with the DROP action means any matching request is rejected right away, rather than being forwarded. Binding this policy globally with the REQ_OVERRIDE type ensures this decision overrides normal processing for all traffic that meets the criteria, applying the rule consistently across the entire deployment.

This is the right approach because it targets exactly the scenario: large POST requests. The other options don’t fit as well: using OR would trigger on either condition, not on both; targeting GET misses the requirement; and binding a rewrite policy (even with REQ_OVERRIDE) is not the same as blocking at the responder/request stage, which is what a DROP in a responder policy achieves.