ITPEC FE Morning October 2018 Question 45
ITPEC FE Morning October 2018 — Question 45 of 80
Web Application Firewall (WAF) — A security device placed between a client and a web server that inspects HTTP requests and blocks application-layer attacks.
A WAF analyzes incoming data from clients to the web server and filters out malicious payloads such as SQL injection, cross-site scripting (XSS), and other web-based attacks.
Correct answer: d) WAF
A WAF sits inline between the client and the web server, inspecting request data at the application layer (Layer 7). It uses signature-based and behavioral rules to detect and block attacks like SQL injection before they reach the server.
Why not the others:
- a) Cluster configuration — refers to grouping servers for high availability or performance, not for inspecting or filtering traffic
- b) Load balancing function — distributes incoming traffic across multiple servers to optimize resource usage; it does not inspect request content for attacks
- c) SSL-VPN function — provides encrypted remote access to a private network; it secures the transport channel but does not inspect application-layer data for attacks
Key rule: WAF = application-layer firewall that inspects HTTP/HTTPS traffic content. Regular firewalls filter by IP/port; WAF filters by request content (headers, body, parameters).
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.