Web Application Firewall (WAF) CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A WAF administrator needs to configure a rule that only allows requests to /api/orders with a valid API key in the 'X-API-Key' header. All other requests should be blocked. Which WAF rule configuration best achieves this?

   • AAllow all requests to /api/orders and rely on the application to validate the API key
   • BBlock all requests to /api/orders unless the 'X-API-Key' header is present and matches a known pattern
   • CLog all requests to /api/orders and allow them
   • DBlock requests to /api/orders that contain a known SQL injection signature
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After deploying a WAF with default rules, legitimate users are being blocked when they submit a form that includes a text field containing the word 'select' in a sentence. The WAF logs show the requests are being blocked by a SQL injection rule. What is the best action to reduce false positives while maintaining security?

   • AChange the rule action from block to log for all SQL injection rules
   • BIncrease the request body size limit
   • CAdd an exception rule that allows the specific form field while keeping the SQL injection rule active for other fields
   • DDisable the SQL injection rule entirely
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which WAF tuning approach would reduce false positives while maintaining security coverage?

   • ASetting the WAF to log-only mode permanently.
   • BDisabling all WAF rules to avoid blocking legitimate traffic.
   • CIncreasing the WAF's sensitivity to block more traffic.
   • DRefining rules to be more specific, such as requiring multiple conditions to match before blocking.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a common cause of false positives in a WAF?

   • AThe WAF being placed in a passive monitoring mode.
   • BInsufficient logging of allowed traffic.
   • CThe WAF not having a rule for a specific attack.
   • DOverly broad rules that match legitimate traffic as malicious.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A WAF administrator is configuring a rule to block HTTP parameter pollution (HPP) attacks. The application uses the first value of a duplicated parameter. An attacker sends: /api/transfer?amount=100&amount=10000. Which WAF rule best mitigates this attack?

   • ABlock requests where the parameter value contains a comma
   • BAllow requests with duplicate parameters and rely on the application to use the last value
   • CLog requests with duplicate parameters and allow them
   • DBlock requests that contain duplicate parameter names
   Reveal Solution Discussion Select an answer first