ISC2 CCSP Exam - Topic 11 Question 40 Discussion

Actual exam question for ISC2's CCSP exam

Question #: 40
Topic #: 11

[All CCSP Questions]

Web application firewalls (WAFs) are designed primarily to protect applications from common attacks like:

ARansomware

BSyn floods

CXSS and SQL injection

DPassword cracking

Show Suggested Answer

Suggested Answer: C

WAFs detect how the application interacts with the environment, so they are optimal for detecting and refuting things like SQL injection and XSS. Password cracking, syn floods, and ransomware usually aren't taking place in the same way as injection and XSS, and they are better addressed with controls at the router and through the use of HIDS, NIDS, and antimalware tools.

by Blair at May 08, 2022, 12:21 PM

Limited Time Offer

25%

Off

Get Premium CCSP Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ricarda

4 months ago

Password cracking? I thought that was more about user practices.

upvoted 0 times

...

Dalene

4 months ago

Syn floods aren't really a WAF focus, right?

upvoted 0 times

...

Alisha

4 months ago

Wait, are WAFs really effective against ransomware?

upvoted 0 times

...

Peter

4 months ago

Totally agree, those are the big ones!

upvoted 0 times

...

Leontine

5 months ago

WAFs mainly protect against XSS and SQL injection.

upvoted 0 times

...

Hollis

5 months ago

I thought WAFs could help with password cracking too, but I guess that's more about user authentication than application protection.

upvoted 0 times

...

Broderick

5 months ago

I practiced a similar question, and I believe XSS and SQL injection are the most common threats that WAFs defend against.

upvoted 0 times

...

Cherrie

5 months ago

I'm not entirely sure, but I remember something about WAFs being less effective against network layer attacks like Syn floods.

upvoted 0 times

...

Ronnie

5 months ago

I think WAFs mainly focus on application layer attacks, so I'm leaning towards XSS and SQL injection.

upvoted 0 times

...

Antonio

5 months ago

Hmm, the wording is a bit confusing. I'll need to read through it carefully to figure out the best approach.

upvoted 0 times

...

Krissy

5 months ago

I remember studying Penn Central Transportation Co. v New York City as a key case in preservation law, but I can't recall if it was the first one.

upvoted 0 times

...

Orville

5 months ago

Option D feels a bit too aggressive with "positioning" new technology. I recall us saying it's more about understanding the customer's needs first.

upvoted 0 times

...

Delmy

5 months ago

Okay, I think I've got this. The key is to grant the appropriate permissions to Rubio and Doe to modify the Project relation, while also giving Temp the ability to access the data for reporting. I'll carefully consider each option to find the best solution.

upvoted 0 times

...

Carin

5 months ago

Hmm, I'm a bit unsure about this one. I know risk aversion is about being cautious with risks, but I'm not sure which of these options best captures that concept. I'll have to re-read the question and think it through.

upvoted 0 times

...