Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company wants to validate that their WAF rules are effective against new vulnerabilities that are disclosed weekly. They have a limited security budget and cannot afford a full-time penetration tester. Which approach is most cost-effective and sustainable?

   • AHire a penetration testing firm to test the WAF once a year.
   • BWait for a real attack to occur and then adjust the WAF rules.
   • CManually review the WAF rule updates from the vendor and apply them without testing.
   • DUse an automated WAF testing tool that is updated with the latest vulnerability signatures and run it in the CI/CD pipeline on a regular basis.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which practice is commonly used to manage WAF configuration in a CI/CD pipeline?

   • AUsing a spreadsheet to track WAF rule changes.
   • BRecreating the WAF from scratch for every application release.
   • CStoring WAF rules in a version control system and deploying them via automation scripts.
   • DManually updating WAF rules in the production console after each deployment.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company runs a customer-facing web application behind an on-premises WAF. After a recent surge in SQL injection attempts, the security team wants to add a rule that blocks requests containing the string 'UNION SELECT' in the query string. However, the application legitimately uses a parameter named 'union_select' for a reporting feature. Which configuration approach best addresses this requirement without breaking the legitimate feature?

   • ACreate a custom rule that inspects only the query string parameter values, excluding the parameter names, and blocks only if the value matches the pattern.
   • BCreate a rule that blocks any request containing 'union' in the query string, regardless of context.
   • CEnable the built-in SQL injection rule set and set the action to 'Block' for all requests.
   • DDisable the built-in SQL injection rules and rely on the network firewall to block SQL injection attempts.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A DevSecOps team manages a web application that is deployed multiple times a day. They want to ensure that WAF rule changes are tested and deployed consistently with each application release. Which approach best integrates WAF management into their CI/CD pipeline?

   • AHave the security team review and apply WAF changes only during quarterly maintenance windows.
   • BUse a separate pipeline that runs nightly to sync WAF rules from a shared file, without testing.
   • CStore WAF configuration as code in the same repository as the application, and use a pipeline stage to apply and validate the WAF rules in a staging environment before production.
   • DManually update WAF rules in the production WAF after each application deployment.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a security incident, the incident response team needs to determine whether a web application was exploited via an SQL injection attack. The WAF is in place. What should the team do first?

   • AReview the WAF logs for the incident timeframe to identify blocked or allowed requests that match SQL injection patterns.
   • BContact the WAF vendor to ask if the attack was successful.
   • CRestore the application from a backup taken before the incident.
   • DShut down the web server immediately to prevent further damage.
   Reveal Solution Discussion Select an answer first