Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the goal of tuning WAF rules?

   • ATo eliminate the need for security monitoring
   • BTo block all traffic to the application
   • CTo reduce false positives while maintaining effective security
   • DTo increase the number of false positives
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company's web application has been hit by a credential-stuffing attack where attackers use lists of usernames and passwords from other breaches. The application does not have multi-factor authentication (MFA) yet. What WAF configuration provides the most immediate mitigation?

   • AConfigure the WAF to redirect all login traffic to a honeypot
   • BSet the WAF to log all login attempts and review them at the end of the month
   • CEnable rate limiting on the login endpoint and block IP addresses that exceed the threshold
   • DEnable a rule that blocks all login requests containing the word 'password'
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary role of a Web Application Firewall (WAF) in a cloud environment?

   • ATo encrypt all data stored in a cloud database using AES-256.
   • BTo manage user identities and access permissions for a cloud application.
   • CTo filter and monitor HTTP/HTTPS traffic between a web application and the internet, blocking malicious requests based on rules.
   • DTo provide a virtual private network (VPN) for secure remote access to cloud resources.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's web application uses a third-party library with a known remote code execution vulnerability. The vendor will not release a patch for two weeks. The security team needs to protect the application immediately while the patch is developed. What is the best WAF strategy?

   • ADisable the vulnerable library's functionality in the application code
   • BBlock all traffic to the application until the patch is available
   • CCreate a virtual patch by writing a custom WAF rule that blocks the specific exploit signature
   • DIncrease the WAF logging level to capture all exploit attempts
   Reveal Solution Discussion Select an answer first
6. 40application · easy

   A security analyst is reviewing WAF logs and notices repeated attempts to submit payloads like 'admin' OR '1'='1' to a search field, and also sees requests with '<script>alert(1)</script>' in the URL. Which two OWASP Top Ten risk categories are being attempted?

   • AInjection and Cross-Site Scripting (XSS)
   • BBroken Authentication and Sensitive Data Exposure
   • CSecurity Misconfiguration and XML External Entities
   • DInsecure Deserialization and Using Components with Known Vulnerabilities
   Reveal Solution Discussion Select an answer first