Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is insufficient logging and monitoring a security risk?

   • AIt allows attackers to bypass encryption
   • BIt makes it difficult to detect and respond to attacks in a timely manner
   • CIt causes the application to run slower
   • DIt prevents the application from scaling
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a common vulnerability related to broken authentication?

   • AImproper error handling
   • BWeak password policies
   • CUnencrypted database storage
   • DMissing input validation
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's web application was recently compromised due to a misconfigured server that exposed internal directories. The security team wants to use a WAF to mitigate similar misconfigurations. Which WAF policy is most effective?

   • ADefault-deny policy that blocks requests to known sensitive paths like /config, /backup, and /.git
   • BAllow all requests and rely on the application's access controls
   • CRate-limit all requests to 10 per minute per IP
   • DEnable logging for all requests to sensitive paths
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary goal of sensitive data exposure prevention?

   • ATo block all external access to the application
   • BTo restrict access to the database to only the application server
   • CTo ensure that sensitive data is encrypted both in transit and at rest
   • DTo delete all sensitive data after a certain period
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A retail company's e-commerce site, fronted by a cloud WAF, is experiencing a spike in failed login attempts that include SQL syntax in the username field. The security team wants to block these requests immediately without disrupting legitimate users who occasionally mistype their credentials. What should the WAF administrator configure?

   • ASet a rate limit of 5 requests per minute per IP address on the login page
   • BCreate a custom rule to block any request containing the word 'SELECT' in the body
   • CEnable a managed SQL injection rule set in block mode for the login endpoint
   • DPlace the WAF in detection mode and review logs for a week before taking action
   Reveal Solution Discussion Select an answer first