Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security team wants to set up alerting for their WAF to notify them of potential attacks. They are concerned about alert fatigue from false positives. Which configuration is most effective?

   • ACreate alerts for high-severity rule matches and aggregate low-severity events into a daily summary.
   • BDisable all alerts and only review logs weekly.
   • CAlert on every WAF block event, regardless of severity.
   • DSend all alerts to a distribution list that includes the entire company.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a security incident, the incident response team needs to determine the scope of a potential attack. The WAF logs show that a specific IP address made many requests with SQL injection payloads. What should the team do to assess the impact?

   • ADisable the WAF rule that allowed the requests.
   • BCorrelate the WAF logs with application logs to see if any of the requests were successful in reaching the database.
   • CBlock the IP address in the WAF immediately.
   • DRestore the database from a backup.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A DevSecOps team manages a web application that is deployed in a hybrid model: the application runs on-premises in a data center, but the team wants to use a cloud-based WAF for protection. The application's DNS is managed by an external provider. The team needs to ensure that the WAF can inspect and filter traffic before it reaches the on-premises servers. What should the team configure?

   • ACreate a VPN tunnel between the on-premises network and the cloud WAF, then route all HTTP traffic through the tunnel.
   • BPoint the application's DNS record to the cloud WAF's IP address and configure the WAF to forward traffic to the on-premises server's public IP.
   • CInstall a WAF agent on the on-premises web server and configure it to send logs to the cloud WAF for analysis.
   • DMigrate the application to the cloud provider's PaaS service so the WAF can be automatically attached.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which method is commonly used to simulate attack scenarios to validate WAF effectiveness?

   • APerforming a full network port scan of the WAF.
   • BSending crafted HTTP requests that contain known attack payloads.
   • CChecking the WAF's power supply.
   • DReviewing the WAF's user manual.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   During the Operate and Monitor stage, why is a WAF considered a critical security control for a web application?

   • AIt ensures that the application is always available and never experiences downtime.
   • BIt provides a first line of defense against application-layer attacks, complementing other security measures.
   • CIt eliminates the need for network firewalls and intrusion detection systems.
   • DIt guarantees that all application vulnerabilities are patched automatically.
   Reveal Solution Discussion Select an answer first