IPA FE Subject A 2023 Question 10
A question IPA Japan published in 令和５年度 基本情報技術者試験 科目A 公開問題 問10, translated into English. ITPEC is based on the same exams.
Same question on ITPEC: Oct 2025 Q33
In a system with the configuration and communication services shown in the figure below, which of the following is the most appropriate location for the installation of a WAF as a countermeasure for a vulnerability in a web application? Here, the WAF has no function to encrypt or decrypt communications.
Explanation
C — a WAF that cannot decrypt must sit where the traffic is already plain HTTP, between the SSL accelerator and the web server.
A WAF (Web Application Firewall) inspects the content of HTTP requests, such as parameters and bodies, to block attacks like SQL injection and cross-site scripting against the web application. It can only do that on readable traffic.
- •A and B — the traffic is still HTTPS, encrypted, so the WAF cannot see the requests.
- •C — the SSL accelerator has decrypted the traffic, so plain HTTP reaches the web server here.
- •D — the link from the web server to the database carries database access, not the users' HTTP requests.
Answer (c)
Why not others:
- •(a) A — encrypted HTTPS traffic arriving from the Internet; the WAF has no decryption function.
- •(b) B — still HTTPS between the firewall and the SSL accelerator, so equally unreadable.
- •(d) D — by this point the malicious request has already reached the web application; a WAF must stand in front of the web server, not behind it.
Key rule: Place a WAF after TLS termination and in front of the web server it protects, unless the WAF itself terminates TLS.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.