Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security operations center (SOC) receives hundreds of WAF alerts per day, most of which are false positives. The SOC team is overwhelmed and may miss real attacks. Which strategy is most effective to improve the signal-to-noise ratio without losing critical alerts?

   • AImplement a scoring system that correlates WAF alerts with other signals (e.g., IP reputation, rate of requests) and only alerts on high-confidence matches.
   • BDisable all WAF alerts and rely on manual log review once a week.
   • CSend all alerts to a separate email address that is checked by a junior analyst.
   • DIncrease the severity threshold for all WAF rules so that only the most severe events trigger alerts.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst notices that the WAF is blocking a large number of requests from a specific IP range. The analyst wants to determine whether these blocks are due to a legitimate attack or a misconfigured rule. Which action provides the most useful information to make this determination?

   • AReview the WAF logs for the blocked requests, including the matched rule IDs and the full request payloads.
   • BImmediately block the entire IP range at the network firewall.
   • CDisable the WAF temporarily to allow all traffic through.
   • DCheck the web server access logs only, ignoring WAF logs.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which approach is most effective for reducing false positives in a WAF while maintaining security?

   • AUsing a more restrictive rule set to block more traffic.
   • BAdjusting rule sensitivity and creating exceptions for known legitimate traffic patterns.
   • CDisabling all WAF rules to avoid blocking legitimate traffic.
   • DIncreasing the logging level to capture more data.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's WAF is blocking legitimate users who submit forms that contain the word 'select' in a text field. The security team confirms that the WAF's SQL injection rule is too broad for this field. What is the most appropriate way to reduce false positives while maintaining protection?

   • AIncrease the WAF's sensitivity threshold so that it blocks more requests.
   • BAdd an exception rule that allows the specific form field, while keeping the SQL injection rule enabled for all other fields.
   • CDisable the SQL injection rule entirely.
   • DChange the application to avoid using the word 'select' in any form field.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses a CI/CD pipeline to deploy a web application. They want to automatically update the WAF with new rules whenever the application code changes. Which approach is most aligned with DevSecOps principles?

   • AHave a security engineer manually update the WAF after each deployment.
   • BInclude a pipeline stage that applies WAF rule changes from a version-controlled configuration file and runs automated tests against the staging environment.
   • CUse a scheduled job that copies the WAF configuration from production to staging.
   • DOnly update the WAF when a security incident occurs.
   Reveal Solution Discussion Select an answer first