Web Application Firewall (WAF) CASENET Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common WAF bypass technique that involves encoding the payload to evade signature-based detection?

   • AUsing a different web browser.
   • BSending the request over HTTPS.
   • CIncreasing the request timeout.
   • DURL encoding the payload, such as %27 for a single quote.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A DevOps team is integrating WAF rule changes into their CI/CD pipeline. They need to ensure that new rules do not introduce false positives that block legitimate traffic. Which approach best balances speed and safety?

   • ADeploy new rules in log-only mode to a staging environment, analyze the logs for false positives, and then promote to block mode in production
   • BDeploy new rules directly to production in block mode
   • CUse a separate pipeline that does not include automated testing
   • DDeploy new rules to production in log-only mode and never enable block mode
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a WAF with a negative security model that blocks known SQL injection patterns. The security team wants to reduce false positives while maintaining protection against unknown attacks. Which approach is the best?

   • AImplement a positive security model for critical parameters while keeping the negative model for other inputs
   • BRemove the negative model and rely only on the positive model
   • CIncrease the sensitivity of the negative model rules
   • DDisable the negative model for all parameters
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After deploying a WAF with a strict SQL injection rule, legitimate users report that search queries containing the word 'OR' are being blocked. What is the best way to reduce false positives while maintaining protection?

   • ADisable the SQL injection rule entirely
   • BRefine the WAF rule to require SQL-specific patterns like 'OR 1=1' or 'UNION SELECT'
   • CChange the rule action from block to log for all traffic
   • DAdd a rule to allow all requests containing the word 'OR'
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What type of information is typically found in a WAF log entry for a blocked request?

   • AThe plaintext passwords of all users.
   • BThe full database schema of the application.
   • CThe internal network topology of the application server.
   • DSource IP address, request URL, HTTP method, and the rule that triggered the block.
   Reveal Solution Discussion Select an answer first