Web Application Firewall (WAF) Integration ECDE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A DevSecOps team is implementing a WAF for a new web application. They want to ensure that the WAF provides value during the Operate and Monitor stage. Which activity best demonstrates the WAF's role in this stage?

   • AUsing the WAF to store application data.
   • BUsing the WAF to replace the need for application code reviews.
   • CContinuously monitoring WAF logs and alerts to detect and respond to attacks in real time.
   • DConfiguring the WAF once during deployment and never reviewing it again.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   After deploying a WAF in front of a web application, the security team notices that legitimate users are being blocked when they submit forms that contain special characters like apostrophes. The WAF is using a managed rule set. What should the team do to reduce false positives without weakening security?

   • AUse the WAF's anomaly scoring feature to allow requests that only trigger low-severity rules, and block only when the score exceeds a threshold.
   • BAdd the users' IP addresses to an allowlist so they are never blocked.
   • CDisable the managed rule set and write custom rules that are more specific to the application.
   • DSet the WAF to 'Detection mode' so it only logs but never blocks.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company has a mix of on-premises legacy applications and cloud-based applications. They want a single WAF solution that can protect both environments with consistent policies. Which deployment model best meets this requirement?

   • ACloud-based WAF only, and migrate all on-premises applications to the cloud.
   • BHybrid WAF deployment with centralized policy management across on-premises and cloud instances.
   • CUse separate WAF solutions for each environment without centralized management.
   • DOn-premises WAF only, and route cloud traffic through the on-premises data center.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   After a WAF alert indicates a possible SQL injection attack, the incident response team needs to determine the scope of the attack. Which action is most important for their investigation?

   • AExtract the source IPs, timestamps, and payloads from WAF logs and correlate them with application logs.
   • BChange all user passwords in the database.
   • CImmediately shut down the web server to prevent further attacks.
   • DDelete the WAF logs to free up storage space.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A DevSecOps team wants to validate that their WAF rules effectively block OWASP Top 10 attacks. They have a staging environment that mirrors production. Which testing method is most appropriate?

   • AAsk the development team to write unit tests for the WAF rules.
   • BUse an automated security testing tool that generates attack payloads for each OWASP category and verify the WAF blocks them.
   • CReview the WAF rule documentation to confirm coverage of OWASP Top 10.
   • DPerform a penetration test against the production environment without informing the WAF team.
   Reveal Solution Discussion Select an answer first