Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of traffic does a Web Application Firewall (WAF) primarily inspect?

   • AHTTP/HTTPS requests and responses
   • BSMTP email messages
   • CDNS queries
   • DTCP SYN packets
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web application recently suffered a SQL injection attack via a login form. The security team has deployed a WAF and wants to block similar attacks while allowing legitimate login attempts. Which WAF rule configuration should they implement?

   • AEnable the OWASP Core Rule Set (CRS) SQL injection rules in block mode for the login URL
   • BSet the WAF to monitor mode and log all login requests for later review
   • CRate-limit login requests to 10 per minute per IP address
   • DBlock all requests containing the string 'OR 1=1' in any parameter
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company's SOC is overwhelmed by WAF alerts, most of which are false positives. They are missing real attacks because the alert volume is too high. The SOC wants to reduce alert noise while ensuring critical attacks are still detected. What is the best approach?

   • AIncrease the sensitivity of all WAF rules to catch more attacks
   • BSet the WAF to block all traffic that triggers any rule
   • CTune the WAF rules to reduce false positives and set up alert aggregation to group similar events
   • DDisable all WAF alerts and rely on manual log review
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which WAF rule action would you use to allow traffic from a known good IP address while still monitoring for attacks?

   • AAllow
   • BMonitor
   • CBlock
   • DChallenge
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A web application accepts XML from partners, and the security team has deployed a WAF. The WAF is blocking legitimate XML that contains a DOCTYPE declaration used for entity expansion. The team wants to block XXE attacks without breaking legitimate XML. Which approach is most effective?

   • ARate-limit XML requests to 1 per minute per partner
   • BBlock DOCTYPE declarations that reference external entities, but allow internal entity declarations
   • CAllow all DOCTYPE declarations and rely on the XML parser to prevent XXE
   • DBlock all DOCTYPE declarations
   Reveal Solution Discussion Select an answer first