Which configuration uses a responder policy to block POST requests with content length greater than 10000 bytes?

• A. add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ(\"POST\") && http.REQ.CONTENT_LENGTH.GT(10000)" add rewrite policy drop_rewrite expr_hashdos_prevention DROP bind rewrite global drop_rewrite 100 END type REQ_OVERRIDE
• B. add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ(\"POST\") || http.REQ.CONTENT_LENGTH.GT(10000)" add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP bind responder global pol_resp_hashdos_prevention 70 END type REQ_OVERRIDE
• C. add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ(\"POST\") && http.REQ.CONTENT_LENGTH.GT(10000)" add responder policy pol_resp_hashdos_prevention expr_hashdos_prevention DROP NOOP bind responder global pol_resp_hashdos_prevention 70 END type REQ_OVERRIDE
• D. add policy expression expr_hashdos_prevention "http.REQ.METHOD.EQ(\"POST\") && http.REQ.CONTENT_LENGTH.GT(10000)" add rewrite policy drop_rewrite expr_hashdos_prevention DROP bind rewrite global drop_rewrite 100 END type REQ_OVERRIDE

Answer: (C)

To block these requests, you need a responder policy that drops the request when specific request attributes match. The key is to evaluate both conditions together and take the drop action at the moment the request arrives.

The expression used checks that the HTTP method is POST and that the request content length is greater than 10000 bytes, joined with a logical AND. This means a request will only be dropped if both conditions are true, precisely targeting POST requests that are unusually large.

Using a responder policy with the DROP action ensures the request is terminated before it reaches any backend, rather than modifying or rewriting the request. Binding this policy globally with a priority (and using REQ_OVERRIDE) makes sure the rule applies to all relevant traffic at the correct stage of processing.

Why the other options don’t fit: one uses a rewrite policy instead of a responder policy, which changes the flow of handling rather than directly dropping the request; another uses OR, which would drop more traffic (any POST or any large request) rather than only POSTs with large bodies; the remaining rewrite-based option would also not apply the drop through a responder policy.