Web Application Firewall (WAF) CASENET Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A WAF is configured to block requests containing 'UNION SELECT' in the query string. An attacker sends: /products?id=1%20UNION%20SELECT%20username%20FROM%20users. The WAF does not block it. The application is vulnerable to SQL injection. What is the most likely reason the WAF failed?

   • AThe WAF rule only inspects POST bodies, not query strings
   • BThe WAF is deployed in bridge mode, which does not inspect HTTP
   • CThe WAF rule is case-sensitive and the payload uses lowercase
   • DThe WAF is not decoding URL-encoded characters before applying the rule
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security team is comparing a WAF and a RASP solution for a .NET application. The application has a critical vulnerability that cannot be patched immediately. The team wants to block attacks against this vulnerability while the patch is developed. Which solution is more appropriate in this scenario?

   • AUse an IDS to alert on the attack pattern
   • BDisable the vulnerable feature until the patch is available
   • CDeploy RASP to detect and block the attack inside the application
   • DDeploy a WAF with a virtual patch rule that blocks the specific attack pattern
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   How does a Web Application Firewall (WAF) differ from an Intrusion Detection System (IDS) in terms of its primary function?

   • AA WAF operates at the network layer, while an IDS operates at the application layer.
   • BA WAF only logs traffic, while an IDS actively modifies application code to fix vulnerabilities.
   • CA WAF actively blocks malicious HTTP requests, while an IDS primarily monitors and alerts on suspicious activity without necessarily blocking it.
   • DA WAF is a passive device that only detects attacks, while an IDS is an active device that blocks all traffic.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company wants to deploy a WAF in front of a public-facing ASP.NET application. The WAF should be the only entry point for HTTP traffic, and the application server should not be directly accessible from the internet. Which deployment mode should be used?

   • ATransparent proxy mode
   • BReverse proxy mode
   • CBridge mode
   • DInline mode
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What is a key difference between a Web Application Firewall (WAF) and a network firewall?

   • AA WAF is a hardware device, while a network firewall is always software-based.
   • BA WAF operates at Layer 7 and inspects HTTP/HTTPS content, while a network firewall operates at Layers 3 and 4 and filters based on IP addresses and ports.
   • CA WAF only monitors outbound traffic, while a network firewall only monitors inbound traffic.
   • DA WAF is used to block malware downloads, while a network firewall is used to block web attacks.
   Reveal Solution Discussion Select an answer first