Web Application Firewall (WAF) CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key benefit of integrating WAF configuration and testing into a CI/CD pipeline?

   • AIt automatically fixes all application vulnerabilities.
   • BIt allows WAF rules to be validated and updated alongside application code, ensuring security controls are tested before deployment.
   • CIt eliminates the need for any manual security testing.
   • DIt guarantees that no false positives will occur in production.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a WAF in front of an ASP.NET application that allows users to submit product reviews. The WAF is blocking legitimate reviews that contain the word 'select' in a sentence. The security team wants to reduce false positives without weakening protection against SQL injection. Which approach is the best?

   • ACreate a positive security model rule that allows only alphanumeric characters and a defined set of punctuation in the review field
   • BChange the WAF to log-only mode for all SQL injection rules
   • CDisable the SQL injection rule for the review field
   • DAdd the word 'select' to a global whitelist of allowed words
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which WAF security model would you implement to allow only requests that match a predefined set of allowed HTTP methods, URL patterns, and parameter types?

   • ANegative security model
   • BHybrid security model
   • CSignature-based model
   • DPositive security model
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In which WAF deployment mode does the WAF operate as a transparent proxy, requiring no changes to the client's browser configuration?

   • ATransparent proxy mode
   • BReverse proxy mode
   • CBridge mode
   • DInline mode
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst notices that a WAF rule designed to block SQL injection is not catching requests like: /products?id=1%27%20OR%20%271%27%3D%271. What is the most likely reason?

   • AThe WAF is deployed in bridge mode
   • BThe application is using parameterized queries
   • CThe WAF is not decoding URL-encoded payloads before applying the rule
   • DThe WAF rule is configured to only inspect POST bodies
   Reveal Solution Discussion Select an answer first