Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A development team has deployed a new web application with several debug endpoints enabled by mistake. These endpoints expose internal configuration details. The team cannot redeploy the application until the next release cycle. What WAF configuration should be used to mitigate this security misconfiguration?

   • ASet the WAF to log all requests to the debug endpoints for later review
   • BEnable a rule that blocks all requests with a 'User-Agent' header containing 'curl'
   • CConfigure the WAF to redirect all traffic to the application's home page
   • DCreate a default-deny rule that blocks access to any path containing '/debug' or '/internal'
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A Java-based web application accepts serialized objects from clients. The security team is concerned about insecure deserialization attacks where a malicious object could execute arbitrary code. The application code cannot be changed immediately. What is the most effective WAF approach?

   • ASet the WAF to log all serialized object requests for forensic analysis
   • BConfigure the WAF to block all POST requests to the application
   • CCreate a custom WAF rule that inspects request bodies for known Java deserialization gadget signatures and blocks them
   • DEnable a rule that blocks all requests with a 'Content-Type' of 'application/x-java-serialized-object'
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company's web application has a login page that is frequently targeted by credential stuffing attacks. The security team has deployed a WAF and wants to block these attacks without blocking legitimate users who may share a corporate NAT IP. Which WAF configuration is most effective?

   • AImplement a WAF rule that challenges suspicious requests with a CAPTCHA or JavaScript challenge
   • BBlock all requests from IP addresses with a high reputation score
   • CRate-limit login attempts per IP address to 5 per minute
   • DBlock all login requests that contain a password field
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A multinational company has a web application with users in Europe and Asia. They have a strict data residency requirement that all traffic must be inspected within the region where the user is located. They also want to minimize latency. What is the best WAF deployment strategy?

   • AUse an on-premises WAF in the company's headquarters in the United States
   • BUse a CDN with a WAF add-on that inspects traffic at the edge
   • CDeploy a cloud WAF instance in each region (Europe and Asia) and configure traffic to be routed to the nearest WAF instance
   • DDeploy a single WAF instance in Europe and route all global traffic through it
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a common characteristic of a Cross-Site Scripting (XSS) attack?

   • AIt injects malicious scripts into web pages viewed by other users
   • BIt intercepts network traffic between the client and server
   • CIt sends malicious emails to users
   • DIt exploits vulnerabilities in the operating system
   Reveal Solution Discussion Select an answer first