ITPEC FE Subject A October 2025 Question 33
ITPEC FE Subject A October 2025 — Question 33 of 60
WAF placement in network architecture — where to install a WAF that cannot decrypt traffic.
A WAF (Web Application Firewall) inspects HTTP request content (headers, parameters, body) to block attacks like SQL injection and XSS. It needs plaintext HTTP traffic to function.
In this architecture:
- Point A and B carry HTTPS (encrypted) traffic
- The SSL accelerator terminates TLS and forwards plain HTTP from point C onward
- Point D is the internal channel to the database server
Since this WAF has no decrypt function, it must be placed after the SSL accelerator — at point C — where it can inspect the now-decrypted HTTP requests before they reach the web server.
Why not others:
- (a) A — traffic is still HTTPS-encrypted; WAF cannot inspect it
- (b) B — traffic is still HTTPS-encrypted; same problem as A
- (d) D — this is the database access channel; WAF protects against web application attacks in HTTP traffic, not database-layer communication
Key rule: A WAF that cannot decrypt must sit downstream of the SSL termination point, where traffic is already plain HTTP.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.