Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 13)

Questions 61–65

1. 61application · medium

   A web application allows users to log in and maintain a session. The security team has deployed a WAF and wants to detect and block session fixation and session hijacking attempts. Which WAF configuration is most appropriate?

   • ALog all session IDs and compare them to a known list
   • BBlock requests where the session ID in the cookie differs from the session ID in the URL
   • CBlock all requests that contain a cookie header
   • DRate-limit login attempts to 3 per minute per IP
   Reveal Solution Discussion Select an answer first
2. 62application · medium

   A company's security team wants to use a WAF to improve detection of attacks and support incident response. Which WAF feature is most important to enable?

   • ADetailed logging of blocked requests, including source IP, payload, and rule ID
   • BResponse compression for all responses
   • CRate limiting for all endpoints
   • DIP reputation blocking for known malicious IPs
   Reveal Solution Discussion Select an answer first
4. 63application · medium

   A web application is vulnerable to stored XSS because user-generated content is not sanitized. The security team has deployed a WAF and wants to block XSS payloads. Which WAF rule is most effective?

   • ARate-limit all POST requests to 5 per minute per IP
   • BInspect request bodies and block payloads containing '<script>' or event handler attributes like onerror
   • CEnable response compression to reduce payload size
   • DBlock all requests with a Content-Type of text/html
   Reveal Solution Discussion Select an answer first
5. 64foundation · easy

   What is a false positive in the context of WAF rules?

   • AA rule that is too permissive
   • BMalicious traffic that is allowed through because no rule matches
   • CA rule that is not working at all
   • DLegitimate traffic that is incorrectly blocked by a WAF rule
   Reveal Solution Discussion Select an answer first
6. 65application · medium

   A web application deserializes Java objects from client requests. The security team has deployed a WAF and wants to detect and block malicious serialized objects. Which WAF rule is most effective?

   • ARate-limit requests to 1 per minute per user
   • BLog all requests containing the string 'java'
   • CBlock all requests with a Content-Type of application/octet-stream
   • DBlock requests containing Java serialization magic bytes (AC ED 00 05) in the body
   Reveal Solution Discussion Select an answer first