2.03 Determine the Appropriate Security Framework for an Application 401 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which factor is most important when determining whether a security framework should include a web application firewall (WAF) for an application?

   • AThe programming language used to develop the application
   • BThe number of servers in the application's backend pool
   • CThe application's exposure to the internet and its susceptibility to common web attacks
   • DThe application's use of a content delivery network (CDN)
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is migrating a legacy application from a physical server to a virtualized environment. The application is currently protected by a hardware WAF. The security team wants to maintain the same level of protection while reducing hardware dependency. The new environment uses VMware and the application is behind an F5 BIG-IP virtual edition (VE). What is the best approach?

   • AEnable ASM on the BIG-IP VE
   • BRely on the hypervisor's built-in security features
   • CKeep the hardware WAF in the network path
   • DUse a software WAF agent on each application server
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A European company is deploying a web application that collects personal data from users. The application must comply with GDPR, which requires data protection by design and by default. The company uses an F5 BIG-IP for load balancing and wants to add security controls. Which configuration best supports GDPR compliance?

   • AEnable ASM with logging of security events and ensure TLS is enforced for all traffic
   • BDisable logging to minimize data collection
   • CStore all logs on a server in a non-EU country
   • DUse only network-level encryption with IPsec
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is redesigning its security architecture for a new application that will be deployed in a hybrid cloud environment. The application will have a public-facing web tier in the cloud and a private database tier on-premises. The security team needs to protect the web tier from web attacks and ensure secure communication between the cloud and on-premises components. The company has an existing F5 BIG-IP in the data center. Which architecture should be implemented?

   • APlace a WAF on-premises and route all cloud traffic back to the data center
   • BUse only a network firewall in the cloud and no encryption for cloud-to-on-premises traffic
   • CDeploy the BIG-IP in the cloud and route all traffic through it
   • DDeploy a cloud-based WAF in front of the web tier and use an IPsec VPN between the cloud and on-premises BIG-IP
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a primary strength of using a web application firewall (WAF) as part of an application security framework?

   • AIt ensures the application is compliant with all regulatory standards
   • BIt provides real-time protection against common web attacks such as SQL injection and cross-site scripting
   • CIt authenticates users before they access the application
   • DIt encrypts all data at rest in the database
   Reveal Solution Discussion Select an answer first