Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What does an XXE (XML External Entity) attack typically exploit?

   • AWeaknesses in XML parsers that process external entities
   • BInsecure deserialization of Java objects
   • CVulnerabilities in SQL databases
   • DCross-site scripting in web forms
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's security operations center (SOC) is struggling to identify attacks because the WAF logs are stored separately from the application logs and are not correlated. The SOC wants a centralized view to detect multi-step attacks that span both the WAF and the application. What is the most effective approach?

   • ASet the WAF to block all traffic that triggers any rule
   • BEnable verbose logging on the WAF and store logs in the WAF console
   • CIntegrate the WAF with a cloud-native SIEM and forward both WAF and application logs to it
   • DConfigure the WAF to send alerts to the SOC email distribution list
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A web application accepts XML uploads. The security team has deployed a WAF and wants to block XXE attacks. Which WAF rule is most effective?

   • ALog all XML requests for manual review
   • BBlock XML requests containing DOCTYPE declarations with external entities
   • CRate-limit XML uploads to 1 per minute per user
   • DBlock all requests with a Content-Type of application/xml
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the risk of using components with known vulnerabilities?

   • AThe application will automatically become slower
   • BThe application will be unable to scale
   • CThe application will lose all data
   • DAttackers can exploit known weaknesses in libraries or frameworks to compromise the application
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How can a WAF mitigate security misconfigurations using a default-deny policy?

   • ABy logging all traffic but not taking action
   • BBy blocking all traffic that does not match explicitly allowed rules
   • CBy automatically fixing configuration errors in the application
   • DBy allowing all traffic except that which is explicitly blocked
   Reveal Solution Discussion Select an answer first