ITPEC FE Subject A October 2025 Question 33
In a system with the configuration and communication services shown in the figure below, which of the following is the most appropriate location for the installation of a WAF as a countermeasure for a vulnerability in a web application? Here, the WAF has no function to encrypt or decrypt communications.
Explanation
C — a WAF that cannot decrypt must sit where the traffic is already plain HTTP, between the SSL accelerator and the web server.
A WAF (Web Application Firewall) inspects the content of HTTP requests, such as parameters and bodies, to block attacks like SQL injection and cross-site scripting against the web application. It can only do that on readable traffic.
- •A and B — the traffic is still HTTPS, encrypted, so the WAF cannot see the requests.
- •C — the SSL accelerator has decrypted the traffic, so plain HTTP reaches the web server here.
- •D — the link from the web server to the database carries database access, not the users' HTTP requests.
Answer (c)
Why not others:
- •(a) A — encrypted HTTPS traffic arriving from the Internet; the WAF has no decryption function.
- •(b) B — still HTTPS between the firewall and the SSL accelerator, so equally unreadable.
- •(d) D — by this point the malicious request has already reached the web application; a WAF must stand in front of the web server, not behind it.
Key rule: Place a WAF after TLS termination and in front of the web server it protects, unless the WAF itself terminates TLS.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.