ITPEC FE Morning October 2018 Question 45
Between a client and a web server, which of the following is used for inspecting the data that is sent from the client to the web server and blocking attacks such as SQL injection?
Explanation
WAF (web application firewall) — the device placed in front of a web server that inspects the content of HTTP requests and blocks application-layer attacks.
A WAF sits between the clients and the web server and examines what the client actually sends: URL parameters, form fields, cookies and headers. It matches them against signatures and rules for known attack patterns, such as SQL fragments in a form field (SQL injection), script tags (cross-site scripting) or shell metacharacters (OS command injection), and blocks or sanitises the request before it reaches the application.
Answer (d)
Why not others:
- •(a) Cluster configuration — several servers run as one system for availability or performance; it does not look at request content
- •(b) Load balancing function — spreads requests across servers by load or rules; it forwards attacks as readily as normal requests
- •(c) SSL-VPN function — builds an encrypted tunnel for remote access; encryption protects data in transit but does not judge whether the data is an attack
Key rule: A network firewall filters by address and port; a WAF reads the HTTP content itself, which is the only place an injection attack is visible.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.