Web Application Firewall (WAF) CASENET Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In a CI/CD pipeline, which of the following is an appropriate step to test WAF rules?

   • ARunning automated security tests that send malicious payloads to a staging environment protected by the WAF.
   • BDisabling the WAF in production to avoid false positives.
   • CManually reviewing the WAF configuration in a document.
   • DDeploying the WAF rules directly to production without testing.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A WAF administrator is reviewing logs and sees a pattern of requests with a 'Content-Type' header of 'application/x-www-form-urlencoded' but with a body that contains JSON. The requests are being blocked by a rule that inspects JSON payloads. What is the most likely cause, and what should the administrator do?

   • AThe requests are malicious and should be blocked; increase the rule severity
   • BThe WAF is misinterpreting the content type and applying JSON rules to non-JSON requests; update the rule to inspect the actual payload format
   • CThe requests are being blocked due to a network firewall rule; adjust the firewall
   • DThe requests are legitimate and should be allowed; disable the JSON inspection rule
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security architect is designing a defense-in-depth strategy for an ASP.NET application. The team already has a WAF and a network IDS. They want to add a control that can detect and block attacks that the WAF misses, especially those that exploit application logic flaws. Which control should they add?

   • AA network firewall with application-layer inspection
   • BAnother WAF from a different vendor
   • CA host-based intrusion detection system
   • DRuntime application self-protection (RASP)
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following attack patterns would a WAF rule designed to mitigate SQL injection typically look for?

   • ARequests with unusual HTTP methods like TRACE
   • BStrings like ' OR '1'='1' in query parameters
   • CJavaScript code in the URL fragment
   • DLarge file uploads exceeding size limits
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A WAF administrator needs to block requests that attempt to include a file from a remote server, such as http://evil.com/shell.txt, in a parameter. Which WAF rule is most effective?

   • ABlock requests where the User-Agent header contains 'curl'
   • BBlock requests where the request method is POST
   • CBlock requests where a parameter value matches a pattern for http:// or https:// URLs
   • DBlock requests where the parameter name is 'file'
   Reveal Solution Discussion Select an answer first