IPA IP 2024 Question 90
A question IPA Japan published in 令和6年度 ITパスポート試験 公開問題 問90, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate description of a WAF that is used as a security measure?
Explanation
Protects a website from attacks on its web application's vulnerabilities — a WAF (web application firewall) inspects the content of the HTTP traffic to a web application.
An ordinary firewall filters by addresses and ports. A WAF sits in front of a website such as an online shop and examines the requests themselves, blocking patterns of suspicious access such as SQL injection and cross-site scripting that exploit vulnerabilities in the web application software.
Answer (a)
Why not others:
- •(b) — a secure, leased-line-like connection over a public network such as the Internet is a VPN
- •(c) — identifying and monitoring confidential data to prevent its loss or leakage is DLP (data loss prevention)
- •(d) — a buffer zone between the Internet and the internal network, made with a firewall, is a DMZ
Key rule: A WAF protects web applications by inspecting what the HTTP requests contain; a firewall filters by address and port, a VPN protects the path, DLP protects the data.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.