Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A DevSecOps team is integrating WAF rule updates into their CI/CD pipeline. They have a staging environment that mirrors production. The team wants to automatically test WAF rule changes against a set of known attack payloads and a set of legitimate traffic samples before promoting to production. What is the best approach?

   • AIn the pipeline, deploy the WAF rule changes to the staging WAF, run the attack and legitimate traffic tests, and only promote to production if the tests pass.
   • BUse a static analysis tool to review the WAF rules and then deploy to production without testing.
   • CManually test the rules in a separate environment outside the pipeline.
   • DApply the rule changes directly to production and monitor for false positives.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the purpose of a WAF policy in the context of protecting a web application?

   • ATo configure network routing between the WAF and the application server.
   • BTo store encrypted credentials for the application's database.
   • CTo define a set of rules and actions that determine how the WAF handles different types of traffic.
   • DTo manage user access permissions for the WAF management console.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A multinational company operates a web application that must comply with data residency requirements. The application is hosted in a public cloud region in the EU, but the company is considering using a cloud-based WAF that only has points of presence (PoPs) in the US. The security team is concerned about whether the WAF will handle EU user data in a compliant manner. What should the team do?

   • ADeploy an on-premises WAF in the EU data center to ensure all traffic stays within the EU.
   • BUse a hybrid WAF where the inspection engine is in the US but the logs are stored in the EU.
   • CSelect a WAF provider that offers PoPs in the EU and configure the WAF to route traffic through an EU-based PoP.
   • DUse the US-based WAF and rely on the fact that the application data is stored in the EU.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A WAF administrator is tuning rules to reduce false positives. They notice that a rule blocks requests with a certain User-Agent string that is used by a legitimate monitoring service. However, the same User-Agent is also used by a known botnet. What is the best approach to handle this conflict?

   • AChange the monitoring service's User-Agent to something else.
   • BDisable the rule entirely to allow the monitoring service.
   • CBlock all requests with that User-Agent and accept the loss of monitoring.
   • DCreate an exception for the monitoring service's IP addresses, while keeping the rule active for other sources.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company is deploying a WAF for a web application that is hosted in a private cloud on-premises. The company wants to use a cloud-based WAF service to protect the application. The application's DNS is managed by the company's IT team. What is the primary integration consideration?

   • AEnsure that the on-premises firewall allows inbound traffic from the WAF's IP addresses.
   • BUse a WAF that is installed on the same physical server as the application.
   • CMigrate the application to the cloud to simplify WAF integration.
   • DEnsure that the WAF can reach the on-premises application over the internet or a private connection.
   Reveal Solution Discussion Select an answer first