Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security operations center (SOC) is overwhelmed by WAF alerts. Most alerts are false positives caused by legitimate application behavior. The SOC team wants to reduce alert noise while ensuring that real attacks are not missed. What should they do?

   • ADisable WAF alerting and rely on periodic log reviews.
   • BCreate a rule to automatically block any IP that triggers a WAF alert.
   • CTune the WAF rules to reduce false positives and implement alert aggregation and deduplication in the SIEM.
   • DIncrease the severity threshold for all WAF alerts so only critical alerts are sent.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has deployed a WAF and wants to validate that it is not blocking legitimate traffic. They have a set of recorded production traffic that is known to be benign. What should they do?

   • AUse a vulnerability scanner to send attack payloads and see if they are blocked.
   • BReview the WAF logs for any blocked requests and manually determine if they are legitimate.
   • CDisable the WAF and compare application performance.
   • DReplay the recorded traffic through the WAF in a test environment and compare the responses to the original responses.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A DevOps team uses a CI/CD pipeline to deploy a web application. They want to manage WAF rules as code and automatically update the WAF when the application changes. The team uses Git for version control and wants to review changes before they are applied to production. What is the best approach?

   • AHave the application itself call the WAF API to update its own rules during startup.
   • BManually update the WAF through the cloud provider's web console after each deployment.
   • CUse a scheduled job that runs every night to fetch the latest WAF configuration from a shared drive and apply it.
   • DStore WAF configuration in a Git repository and use a pipeline job that runs on merge to the main branch to apply the configuration to the WAF.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team wants to set up WAF monitoring to detect brute-force attacks against a login page. They want to be alerted when there are many failed login attempts from a single IP address. What should they configure?

   • AConfigure the application to send an email for every failed login attempt.
   • BEnable the WAF's default logging and manually review the logs for failed login attempts.
   • CUse a network intrusion detection system (IDS) to monitor traffic to the login page.
   • DCreate a custom WAF rule that tracks the number of requests to the login endpoint from each IP and triggers an alert when the count exceeds a threshold.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A company wants to protect both its on-premises legacy application and a new cloud-hosted application with a single WAF solution. Which deployment model is most appropriate?

   • AHybrid WAF
   • BNetwork-based WAF
   • COn-premises WAF only
   • DCloud-based WAF only
   Reveal Solution Discussion Select an answer first