What is a common high-availability configuration for a WAF to ensure uninterrupted service?

Deploying multiple WAF instances in an active-passive cluster with failover.

Placing the WAF in a log-only mode to avoid blocking traffic.

Using a single WAF instance with a large amount of memory.

Configuring the WAF to automatically disable itself on high load.

A company is deploying a WAF in front of a high-traffic ASP.NET application. The WAF must handle peak traffic without introducing significant latency. Which configuration is the best to achieve both high availability and low latency?

Deploy the WAF in bridge mode to reduce latency

Deploy a single WAF instance with a high-performance specification

Deploy multiple WAF instances behind a load balancer with health checks and auto-scaling

Deploy the WAF in transparent proxy mode to avoid routing changes

A WAF log shows a series of requests to /search.aspx with the parameter 'q' containing values like '%27%20OR%20%271%27%3D%271'. The requests come from a single IP address and are spaced 5 seconds apart. The WAF has a rule that blocks requests containing 'OR 1=1' after URL decoding. The requests are not being blocked. What is the most likely reason?

The WAF rule is case-sensitive and the payload uses lowercase

The WAF is deployed in transparent proxy mode, which does not inspect HTTP

The WAF rule is configured to only inspect POST bodies

The WAF is not decoding the payload before applying the rule

EC-CouncilCertified Application Security Engineer (.NET)

Domain 8Objective 4

Web Application Firewall (WAF) CASENET Practice Questions (Page 9)

Part of the Security Testing and Secure Deployment domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

11concepts

Questions 41–45

41foundation · easy
What is a common high-availability configuration for a WAF to ensure uninterrupted service?
Select an answer first
42expert · hard
A company is deploying a WAF in front of a high-traffic ASP.NET application. The WAF must handle peak traffic without introducing significant latency. Which configuration is the best to achieve both high availability and low latency?
Select an answer first
43foundation · easy
A WAF rule is configured to block requests where the User-Agent header contains 'curl'. What HTTP attribute is this rule inspecting?
Select an answer first
44expert · hard
A WAF log shows a series of requests to /search.aspx with the parameter 'q' containing values like '%27%20OR%20%271%27%3D%271'. The requests come from a single IP address and are spaced 5 seconds apart. The WAF has a rule that blocks requests containing 'OR 1=1' after URL decoding. The requests are not being blocked. What is the most likely reason?
Select an answer first
45application · medium
An attacker is trying to bypass a WAF by sending a request with the payload: /search?q=%u0027%20OR%201%3D1--. The WAF does not decode Unicode escapes. Which bypass technique is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Web Application Firewall (WAF) CASENET Practice Questions (Page 9)

Questions 41–45

What is a common high-availability configuration for a WAF to ensure uninterrupted service?

A company is deploying a WAF in front of a high-traffic ASP.NET application. The WAF must handle peak traffic without introducing significant latency. Which configuration is the best to achieve both high availability and low latency?

A WAF rule is configured to block requests where the User-Agent header contains 'curl'. What HTTP attribute is this rule inspecting?

An attacker is trying to bypass a WAF by sending a request with the payload: /search?q=%u0027%20OR%201%3D1--. The WAF does not decode Unicode escapes. Which bypass technique is being used?

Keep studying — Security Testing and Secure Deployment