Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a common remediation action that can be taken based on WAF alerts?

   • ARestarting the web server.
   • BDeleting the WAF logs.
   • CUpdating WAF rules to block the identified attack pattern.
   • DDisabling the WAF.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is investigating a potential data breach. The WAF logs show that a request with a SQL injection payload was allowed through the WAF. What should the analyst do next?

   • ACheck the application logs to determine if the SQL injection was successful and what data was accessed.
   • BImmediately block the source IP address in the WAF.
   • CRestore the database from a backup.
   • DDisable the WAF rule that allowed the request.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   Before deploying a new WAF rule set to production, a security engineer wants to validate that the rules block known attack patterns without affecting normal traffic. Which testing approach is most effective?

   • ARun a vulnerability scanner against the production application without WAF rules enabled.
   • BReplay a set of recorded legitimate traffic and a set of known attack payloads against the WAF in a staging environment, then compare the results.
   • CAsk the development team to review the rule syntax manually.
   • DDeploy the rules directly to production and monitor for user complaints.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   During a WAF incident, the security team discovers that the WAF blocked an attack, but the attacker may have already exfiltrated data before the block. The team needs to determine the extent of the data breach. Which action is most critical?

   • ARestore the database from the last backup.
   • BNotify law enforcement before any internal investigation.
   • CPreserve and analyze WAF logs, application logs, and database logs to reconstruct the attack timeline and identify data accessed.
   • DImmediately rotate all database credentials and API keys.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the Operate and Monitor stage of a DevSecOps pipeline, what is the primary role of a Web Application Firewall (WAF)?

   • ATo manage user authentication and authorization for web applications.
   • BTo encrypt all data at rest and in transit for web applications.
   • CTo filter and monitor HTTP/HTTPS traffic between web applications and the internet, blocking malicious requests based on rules.
   • DTo replace the need for secure coding practices by automatically fixing code vulnerabilities.
   Reveal Solution Discussion Select an answer first