Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company runs a global web application behind a CDN and wants to apply consistent WAF policies across all edge locations. They also want to centralize WAF logs in a single dashboard. What is the most efficient way to achieve this?

   • AUse the cloud provider's CDN-integrated WAF and configure log forwarding to a centralized logging service
   • BConfigure the CDN to cache all responses and disable the WAF
   • CUse the WAF only for the origin server and rely on the CDN for security
   • DDeploy a separate WAF instance in each region and manage them independently
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's web application uses a third-party library with a known remote code execution vulnerability. The vendor has not yet released a patch. The security team wants to use a WAF to reduce the risk. Which approach is most appropriate?

   • AIncrease logging for all requests to the application
   • BRate-limit all requests to 1 per minute per IP
   • CDisable the vulnerable library immediately
   • DCreate a WAF rule that blocks the specific exploit signatures associated with the vulnerability
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's web application has a broken access control vulnerability where users can access other users' accounts by changing an ID in the URL. The application team cannot fix the code for several weeks. The security team wants to use the WAF to mitigate this. What is the most effective WAF-based mitigation?

   • AEnable rate limiting on the account endpoint to slow down attackers
   • BCreate a WAF rule that blocks requests to the account endpoint if the session cookie does not match the user ID in the URL
   • CEnable IP reputation filtering to block known malicious IPs
   • DBlock all requests to the account endpoint
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company's WAF is blocking a legitimate API client that sends requests with a custom header that matches a WAF rule signature. The API client is used by a critical business partner and cannot be changed. The security team wants to allow this client while maintaining protection for other clients. What is the best approach?

   • ADisable the WAF rule that is causing the false positive
   • BSet the WAF to detection mode for all traffic
   • CModify the partner's API client to remove the custom header
   • DCreate a WAF exception rule that allows requests from the partner's IP address range and skips the signature check for those requests
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company runs a customer-facing web application in a public cloud. The security team wants to inspect all incoming HTTPS traffic for SQL injection and XSS before it reaches the application, without managing any WAF infrastructure. They also need the WAF to automatically scale during peak traffic. Which deployment model best meets these requirements?

   • ACloud-based WAF managed by the cloud provider
   • BHybrid WAF with on-premises inspection and cloud logging
   • CWAF integrated only with the cloud CDN, with no origin inspection
   • DOn-premises WAF appliance in the company's data center
   Reveal Solution Discussion Select an answer first