English
Menu

Cyber Attacks and Defense in Practice

Which of the following correctly describes a WAF (web application firewall)?

  1. AA device that decides whether to pass or block traffic by looking only at IP addresses and port numbers, without examining the content of HTTP
  2. BWith a WAF in place, all attacks including SQL injection can be prevented completely even without fixing the web application's vulnerabilities
  3. CPlaced in front of a web application, it inspects the content of HTTP requests and blocks requests containing typical attack strings
Show answer and explanation

Answer: C. Placed in front of a web application, it inspects the content of HTTP requests and blocks requests containing typical attack strings

Ordinary firewalls control traffic by IP address, port number and so on, so they cannot stop attacks on web applications that pass through the allowed HTTPS port. A WAF inspects the content of HTTP requests, such as the URL, parameters and headers, and blocks requests with patterns typical of SQL injection or cross-site scripting, or requests that do not fit rules defined for the application. It is also used as temporary protection (virtual patching) between the discovery of a vulnerability and the completion of its fix. However, some attacks slip past the rules, so it is not a substitute for fixing the vulnerability itself.

  • A. This describes a packet-filtering firewall. A WAF examines the content of HTTP.
  • B. Some attacks slip past WAF rules. It is not a substitute for fixing vulnerabilities.
  • C. Correct. It inspects the content of HTTP and blocks attacks on web applications.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. An organization places "decoy" files that nobody uses for work, and a decoy administrator account that no system uses, on an internal file server, and monitors access to them. Which of the following is the main advantage of this measure?
  2. The second revision (Rev. 2) of SP 800-61, the incident response guide published by the US NIST in 2012, presents incident response as a cycle of four phases. Which of the following gives the phases in the correct order?
  3. Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?
  4. Evidence from an incident investigation, such as a copy of a disk, is to be handled so that it can later be used in litigation or in a report to the police. Which of the following handling is the most appropriate according to the idea of chain of custody?
  5. Which of the following correctly describes the IoC (indicator of compromise) and IoA (indicator of attack) used in threat detection?

Comparisons in this topic