Web Application Firewall (WAF) and OWASP Top Ten CSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   How does a WAF typically help mitigate SQL injection attacks?

   • ABy inspecting request parameters for malicious SQL patterns and blocking them
   • BBy patching the application code automatically
   • CBy encrypting all database connections
   • DBy disabling the database when an attack is detected
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company has deployed a WAF in front of its web application. After a week, the security team finds that the WAF is blocking a significant number of legitimate requests, and the application team is complaining. The security team wants to reduce false positives while maintaining strong security. Which approach is most effective?

   • AReview WAF logs to identify the specific rules causing false positives, then tune or disable those rules
   • BIncrease the rate limit for all rules to reduce blocking
   • CDisable all WAF rules and rely on the cloud provider's default security
   • DSwitch the WAF to monitoring mode for all rules
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the purpose of the OWASP Top Ten list?

   • ATo list the top ten programming languages for secure development
   • BTo define a set of mandatory security controls for all cloud providers
   • CTo provide a ranking of the most critical security risks to web applications
   • DTo provide a certification for web application security professionals
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company uses a cloud load balancer and a CDN to serve its web application. The security team wants to deploy a WAF with centralized management and consistent policy enforcement across both services. Which integration approach is most appropriate?

   • AEnable WAF features only on the CDN and not on the load balancer
   • BDeploy a separate on-premises WAF for each service
   • CDeploy a cloud WAF and associate it with both the load balancer and the CDN
   • DUse the load balancer's built-in rate limiting instead of a WAF
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   How can a WAF detect malicious serialized objects?

   • ABy blocking all requests that contain binary data
   • BBy encrypting all serialized data
   • CBy inspecting request bodies for known serialization signatures and blocking them
   • DBy disabling serialization in the application
   Reveal Solution Discussion Select an answer first