A security engineer is validating the effectiveness of a newly deployed WAF. The engineer wants to confirm that the WAF blocks SQL injection and XSS attacks without affecting normal traffic. Which testing approach should the engineer use?

Run a set of automated attack simulations against the application through the WAF and compare the results with a baseline of normal traffic.

Ask the development team to test the application without the WAF and compare response times.

Review the WAF configuration and trust that the vendor's default settings are sufficient.

Enable the WAF in 'Detection mode' and wait for a real attack to occur.

EC-CouncilCertified DevSecOps Engineer

Domain 6Objective 5

Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 11)

Part of the Operate and Monitor Stage domain, which makes up ~21% of our current practice bank.

51questions here

11free pages

8concepts

Questions 51–51

51application · medium
A security engineer is validating the effectiveness of a newly deployed WAF. The engineer wants to confirm that the WAF blocks SQL injection and XSS attacks without affecting normal traffic. Which testing approach should the engineer use?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.

Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 11)

Questions 51–51

A security engineer is validating the effectiveness of a newly deployed WAF. The engineer wants to confirm that the WAF blocks SQL injection and XSS attacks without affecting normal traffic. Which testing approach should the engineer use?

Keep studying — Operate and Monitor Stage