Which policy expression matches POST requests with content length greater than 10000 bytes?

Which policy expression matches POST requests with content length greater than 10000 bytes?

• A. "http.REQ.METHOD.EQ(\"POST\") && http.REQ.CONTENT_LENGTH.GT(10000)"
• B. "http.REQ.METHOD.EQ(\"GET\") && http.REQ.CONTENT_LENGTH.GT(10000)"
• C. "http.REQ.METHOD.EQ(\"POST\") || http.REQ.CONTENT_LENGTH.GT(10000)"
• D. "http.REQ.METHOD.NE(\"POST\") && http.REQ.CONTENT_LENGTH.LT(10000)"

Answer: (A)

This is about combining two criteria to match exactly what you want: a POST request where the payload is larger than 10,000 bytes. The right expression uses two checks and ties them together with a logical AND, meaning both conditions must be true. First, it checks the HTTP method and confirms it is POST. Then it checks the request’s content length and ensures it is greater than 10,000 bytes. The combination with && enforces that only requests meeting both conditions are matched. If you used GET instead of POST, or if you used OR, you’d either capture the wrong method or allow matches where only one of the two criteria is met. Using a NOT with POST and a smaller content length would describe the opposite of the target. So, the expression that requires both http.REQ.METHOD.EQ("POST") and http.REQ.CONTENT_LENGTH.GT(10000) is the correct way to match exactly POST requests with a content length over 10,000 bytes.

This is about combining two criteria to match exactly what you want: a POST request where the payload is larger than 10,000 bytes. The right expression uses two checks and ties them together with a logical AND, meaning both conditions must be true.

First, it checks the HTTP method and confirms it is POST. Then it checks the request’s content length and ensures it is greater than 10,000 bytes. The combination with && enforces that only requests meeting both conditions are matched. If you used GET instead of POST, or if you used OR, you’d either capture the wrong method or allow matches where only one of the two criteria is met. Using a NOT with POST and a smaller content length would describe the opposite of the target.

So, the expression that requires both http.REQ.METHOD.EQ("POST") and http.REQ.CONTENT_LENGTH.GT(10000) is the correct way to match exactly POST requests with a content length over 10,000 bytes.