Web Application Firewall (WAF) CASENET Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a characteristic of a WAF deployed in reverse proxy mode?

   • AThe WAF appears to clients as the origin server, and it forwards requests to the actual web server.
   • BThe WAF requires clients to configure their browser to use it as a proxy.
   • CThe WAF is installed as a software agent on the web server.
   • DThe WAF operates at Layer 2 and inspects Ethernet frames.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An attacker is attempting to bypass a WAF by sending a request with a payload that uses both URL encoding and HTTP parameter pollution. The WAF decodes URL encoding but only inspects the first parameter. Which combination of countermeasures is most effective?

   • ADisable URL decoding in the WAF
   • BConfigure the WAF to inspect all parameters with the same name and apply a positive security model to validate input
   • CBlock all requests with multiple parameters of the same name
   • DUse a negative security model to block known attack patterns
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is deploying a WAF in a high-availability configuration. They have two data centers, each with a WAF instance. They need to ensure that if one data center fails, traffic is automatically redirected to the other. Which configuration is the best?

   • ADeploy both WAF instances in the same data center
   • BUse a DNS round-robin configuration without health checks
   • CUse a global load balancer with health checks that routes traffic to the active WAF instance
   • DConfigure the WAF instances in active-active mode without a load balancer
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the fundamental difference between a positive security model and a negative security model in a WAF?

   • AA positive model blocks all traffic by default, while a negative model allows all traffic by default.
   • BA positive model is easier to maintain, while a negative model is more secure.
   • CA positive model allows only known-good traffic, while a negative model blocks known-bad traffic.
   • DA positive model is based on signatures, while a negative model is based on behavioral analysis.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is deploying a WAF in front of a critical .NET application that must remain available. The WAF is a single appliance. What should be done to ensure high availability and avoid a single point of failure?

   • APlace the WAF in bridge mode to minimize latency
   • BConfigure the WAF to log-only mode to reduce overhead
   • CDeploy a second WAF appliance in an active-passive configuration
   • DUse a single WAF with a larger capacity
   Reveal Solution Discussion Select an answer first