Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 12)

Questions 56–60

1. 56foundation · easy

   How can a WAF enforce access control policies?

   • ABy blocking requests to specific URLs based on user roles or IP addresses
   • BBy resetting user passwords
   • CBy scanning for malware in uploaded files
   • DBy encrypting all user data
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   What is virtual patching in the context of a WAF?

   • ABlocking all traffic to the application until it is patched
   • BEncrypting all traffic to prevent exploitation
   • CAutomatically updating the application's dependencies
   • DApplying a temporary rule to block traffic that exploits a known vulnerability until a permanent fix is deployed
   Reveal Solution Discussion Select an answer first
4. 58expert · hard

   A company's web application returns personal data in JSON responses. The security team wants to use a WAF to prevent sensitive data exposure, but the application also returns similar-looking data that must not be masked. Which WAF configuration is most appropriate?

   • AMask all JSON response fields that contain numbers
   • BEnable response masking for specific fields that match a sensitive data pattern, and test against a staging environment
   • CBlock all responses that contain a credit card pattern
   • DEnable TLS 1.3 on the WAF to encrypt all responses
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A healthcare portal stores patient records and recently discovered that an attacker exfiltrated data by injecting a script that read the DOM and sent cookies to an external domain. The application team cannot fix the code immediately. What WAF configuration provides the most immediate protection against this type of data theft?

   • AEnable response masking for all fields containing 'patient' in the name
   • BConfigure the WAF to enforce HTTPS redirects for all incoming traffic
   • CSet the WAF to log all requests and review them weekly
   • DEnable a managed XSS rule set in block mode and add a rule to block requests to known malicious domains
   Reveal Solution Discussion Select an answer first
6. 60foundation · easy

   Which of the following is a common risk category in the OWASP Top Ten?

   • APhishing attacks
   • BMan-in-the-Middle (MitM) attacks
   • CCross-Site Scripting (XSS)
   • DDistributed Denial of Service (DDoS)
   Reveal Solution Discussion Select an answer first