Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A B2B integration platform accepts XML documents from partners. After a security review, the team is concerned about XXE attacks where a malicious document could read local files from the server. The WAF supports custom rules. What is the most effective WAF rule to mitigate this risk?

   • ABlock requests containing the string '<!DOCTYPE' or '<!ENTITY' in the XML body
   • BSet a rate limit on the XML upload endpoint to 10 requests per minute
   • CEnable IP reputation filtering to block requests from suspicious countries
   • DConfigure the WAF to log all XML requests for forensic analysis
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   In a WAF rule, what does the 'rate limiting' action typically do?

   • ARedirects traffic to a honeypot for analysis
   • BLimits the number of requests a client can make within a specified time period
   • CBlocks all traffic from a specific IP address permanently
   • DEncrypts all traffic between the client and the server
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   What is a common benefit of integrating a WAF with a cloud load balancer?

   • ACentralized security management for all traffic distributed by the load balancer
   • BReducing the number of web servers needed
   • CAutomatic scaling of the WAF based on traffic
   • DEliminating the need for encryption
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   How can a WAF help detect and block broken authentication attacks?

   • ABy encrypting session cookies
   • BBy monitoring login attempts and blocking repeated failures from the same IP
   • CBy enforcing strong password policies on the application
   • DBy resetting user passwords automatically
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   After deploying a WAF in block mode, the security team notices that legitimate users are being blocked from submitting forms that contain the word 'select' in a text field. What is the most likely cause and the best next step?

   • AThe WAF is working correctly and the users should change their input
   • BThe WAF should be set to monitor mode to avoid blocking users
   • CThe WAF should be removed because it is not suitable for this application
   • DThe WAF rule is too broad and is causing false positives; the team should tune the rule to be more specific
   Reveal Solution Discussion Select an answer first