CDN CDN Web Application Firewall & Bot Management 2 — Questions and Answers
Question 1: Which bot management technique uses machine learning to distinguish human visitors from automated bots based on behavioral signals?
- CAPTCHA alone
- Static IP blocklist
- Behavioral analytics and fingerprinting (Correct answer)
- HTTP header inspection only
Correct answer: Behavioral analytics and fingerprinting
Behavioral analytics analyzes mouse movements, keystroke cadence, and request patterns to distinguish bots from humans without friction for real users.
Question 2: A company wants to allow Googlebot to crawl their CDN-protected site while blocking all other bots. What is the recommended approach?
- Block all user-agents containing 'bot'
- Use IP allowlisting for Google's published crawler IP ranges combined with user-agent verification (Correct answer)
- Disable WAF for all search engines
- Use a robots.txt exclusion only
Correct answer: Use IP allowlisting for Google's published crawler IP ranges combined with user-agent verification
Verifying Googlebot requires matching its declared user-agent against Google's published IP ranges via reverse DNS lookup, since user-agent alone can be spoofed.
Question 3: What is credential stuffing, and which CDN bot management feature is specifically designed to detect it?
- Injecting scripts into login pages; WAF XSS rules
- Using leaked username/password pairs against login endpoints; high-velocity login attempt detection (Correct answer)
- Stealing SSL certificates; certificate transparency monitoring
- Overloading DNS; anycast routing
Correct answer: Using leaked username/password pairs against login endpoints; high-velocity login attempt detection
Credential stuffing automates login attempts with breached credentials, and CDN bot management detects it by flagging abnormal login request velocity from distributed IPs.
Question 4: Which HTTP response code should a CDN WAF return when it blocks a request matched by a security rule?
- 200 OK
- 301 Moved Permanently
- 403 Forbidden (Correct answer)
- 503 Service Unavailable
Correct answer: 403 Forbidden
403 Forbidden is the standard response indicating the server understood the request but refuses to authorize it, which is appropriate for WAF-blocked requests.
Question 5: What is 'scraping' in the context of CDN bot management, and why is it a concern?
- Removing cached content from edge nodes
- Automated extraction of website content, pricing, or data by bots, consuming bandwidth and exposing proprietary data (Correct answer)
- A technique to speed up image loading
- A DNS pre-fetching strategy
Correct answer: Automated extraction of website content, pricing, or data by bots, consuming bandwidth and exposing proprietary data
Content scraping bots systematically harvest data, increasing origin load and potentially leaking competitive or proprietary information.
Question 6: A WAF rule uses a regex pattern to match request bodies. What performance risk must operators consider at CDN scale?
- Reduced SSL handshake speed
- ReDoS (Regular Expression Denial of Service) due to catastrophic backtracking on complex patterns (Correct answer)
- Increased DNS lookup time
- Lower cache-hit ratios
Correct answer: ReDoS (Regular Expression Denial of Service) due to catastrophic backtracking on complex patterns
Poorly crafted regex patterns can trigger catastrophic backtracking, consuming excessive CPU per request and degrading WAF performance at high traffic volumes.
CDN CDN Web Application Firewall & Bot Management 2
Which bot management technique uses machine learning to distinguish human visitors from automated bots based on behavioral signals?