How does a WAF filter malicious scripts in XSS attacks?

By blocking all requests that contain the letter 's'

By encrypting all JavaScript files

By inspecting request parameters for script tags and event handlers

By disabling JavaScript in the browser

Which of the following is an example of a security misconfiguration?

Implementing multi-factor authentication

Regularly updating software patches

Using strong encryption for data at rest

Leaving default credentials on a cloud database

A company wants to protect a web application hosted in the cloud without managing any WAF infrastructure. Which WAF deployment model best fits this requirement?

Open-source WAF installed on a VM

A company's web application uses a NoSQL database. The security team has a WAF with managed rules for SQL injection, but they are seeing successful NoSQL injection attacks that bypass the WAF. The application team cannot modify the code for a month. What is the most effective immediate mitigation?

Create custom WAF rules that inspect JSON payloads for NoSQL operator syntax like '$gt' or '$ne'

Enable the managed SQL injection rules in block mode

Set the WAF to log all requests and manually review them for NoSQL injection attempts

Block all requests with a 'Content-Type' of 'application/json'

A financial services firm runs a legacy on-premises web application that cannot be modified to add security headers. They are migrating to the cloud and want to protect the application with a WAF while maintaining low latency for users in the same region. The compliance team requires that all traffic be inspected before reaching the application. Which deployment model best meets these requirements?

Install an on-premises WAF appliance in the legacy data center

Rely solely on the cloud provider's default network security groups

Deploy a cloud-based WAF in front of the cloud load balancer

Use a hybrid WAF with on-premises inspection and cloud-based reporting

EC-CouncilCloud Security Essentials

Domain 5Objective 2

Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 7)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

65questions here

13free pages

16concepts

16 Concepts in This Objective

WAF Fundamentals
WAF Deployment Models
WAF Rule Configuration
OWASP Top Ten Overview
Injection Attacks
Broken Authentication and Session Management
Sensitive Data Exposure
XML External Entities (XXE)
Broken Access Control
Security Misconfiguration
Cross-Site Scripting (XSS)
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging and Monitoring
WAF Integration with Cloud Services
WAF Testing and Tuning

Questions 31–35

31foundation · easy
How does a WAF filter malicious scripts in XSS attacks?
Select an answer first
32foundation · easy
Which of the following is an example of a security misconfiguration?
Select an answer first
33foundation · easy
A company wants to protect a web application hosted in the cloud without managing any WAF infrastructure. Which WAF deployment model best fits this requirement?
Select an answer first
34expert · hard
A company's web application uses a NoSQL database. The security team has a WAF with managed rules for SQL injection, but they are seeing successful NoSQL injection attacks that bypass the WAF. The application team cannot modify the code for a month. What is the most effective immediate mitigation?
Select an answer first
35application · medium
A financial services firm runs a legacy on-premises web application that cannot be modified to add security headers. They are migrating to the cloud and want to protect the application with a WAF while maintaining low latency for users in the same region. The compliance team requires that all traffic be inspected before reaching the application. Which deployment model best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.