Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a false positive in the context of WAF rule tuning?

   • AA malicious request that is allowed through the WAF.
   • BA legitimate request that is incorrectly blocked by a WAF rule.
   • CA log entry that is generated for every request.
   • DA rule that is not enabled in the WAF policy.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A WAF is blocking legitimate requests that contain a semicolon in the query string. The application uses semicolons as a delimiter in its API. The security team has confirmed that the requests are not malicious. They want to allow these requests while still protecting against SQL injection. What is the best approach?

   • ASet the WAF to 'Detection mode' for all traffic.
   • BCreate a custom rule that allows requests to the specific API endpoint with a semicolon in the query string, while keeping the SQL injection rule set enabled for other endpoints.
   • CChange the application to use a different delimiter, such as a comma.
   • DDisable the SQL injection rule set globally.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has deployed a WAF in front of its web application. The security team wants to validate that the WAF is correctly blocking OWASP Top 10 attacks. They have a CI/CD pipeline that deploys the application. What should they do to automate this validation?

   • AUse a network packet capture tool to analyze traffic and look for attacks.
   • BReview the WAF configuration and trust that the vendor's default rules are sufficient.
   • CAdd a pipeline stage that runs a security scanner (e.g., OWASP ZAP) against the application through the WAF and fails the build if any attack is not blocked.
   • DManually test the WAF once after deployment using a browser.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A multinational company has a web application that is deployed in multiple regions. Some regions have strict data residency requirements that mandate traffic must not leave the country. The company wants to use a WAF to protect all regions with a consistent security policy. Which deployment model is most appropriate?

   • AUse a single cloud-based WAF in one region and route all traffic through it.
   • BUse a hybrid model with on-premises WAFs in some regions and a cloud WAF in others, but manage policies separately.
   • CDeploy a WAF instance in each region, with a centralized policy management system that pushes the same rules to all instances.
   • DDeploy an on-premises WAF only in the headquarters country and use it for all regions.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is considering moving from an on-premises WAF to a cloud-based WAF. They have a legacy application that uses custom headers and non-standard HTTP methods. The cloud WAF vendor's default rules are known to block these legitimate requests. What is the best way to migrate without disrupting the application?

   • ADisable the default rules and use only custom rules that you write yourself.
   • BKeep the on-premises WAF and do not migrate.
   • CRun the cloud WAF in detection mode initially, analyze the logs to identify false positives, and then create exceptions before switching to blocking mode.
   • DSwitch the cloud WAF to blocking mode immediately and rely on the vendor's support to fix issues.
   Reveal Solution Discussion Select an answer first