CDN CDN Web Application Firewall & Bot Management 1 — Questions and Answers
Question 1: What is the primary purpose of a Web Application Firewall (WAF) deployed at the CDN edge?
- To compress static assets
- To inspect and filter HTTP/HTTPS traffic against application-layer attacks (Correct answer)
- To balance load across origin servers
- To generate SSL certificates
Correct answer: To inspect and filter HTTP/HTTPS traffic against application-layer attacks
A WAF at the CDN edge inspects HTTP/HTTPS requests and blocks application-layer attacks such as SQLi, XSS, and CSRF before they reach the origin.
Question 2: Which OWASP Top 10 threat is most commonly blocked by a CDN WAF rule targeting user-supplied input in URL parameters?
- Broken Access Control
- SQL Injection (Correct answer)
- Insecure Deserialization
- Security Misconfiguration
Correct answer: SQL Injection
SQL Injection attacks typically embed malicious SQL code in URL parameters or form fields, which WAF rules detect and block at the edge.
Question 3: A CDN WAF is configured in 'monitor' mode. What is the effect on malicious traffic?
- Traffic is blocked and logged
- Traffic is allowed but logged for analysis (Correct answer)
- Traffic is rate-limited
- Traffic is redirected to a honeypot
Correct answer: Traffic is allowed but logged for analysis
Monitor (or detection-only) mode logs rule matches without blocking, allowing teams to tune rules before enabling enforcement.
Question 4: What CDN feature allows operators to challenge suspected bots with a JavaScript-based browser check before serving content?
- Rate limiting
- Bot challenge / managed challenge (Correct answer)
- IP allowlisting
- Geo-blocking
Correct answer: Bot challenge / managed challenge
A managed bot challenge presents a transparent JavaScript or CAPTCHA challenge to verify that the client is a real browser, not an automated script.
Question 5: Which metric best indicates that a WAF rule is producing false positives in production?
- High cache-hit ratio
- Spike in legitimate user 403 errors after rule deployment (Correct answer)
- Increase in origin CPU utilization
- Decrease in DNS TTL
Correct answer: Spike in legitimate user 403 errors after rule deployment
A surge in 403 Forbidden responses for known-good users immediately after a rule change strongly indicates the rule is incorrectly blocking legitimate traffic.
Question 6: What is a 'positive security model' WAF approach?
- Blocking only known bad signatures
- Allowing only explicitly defined legitimate request patterns and blocking everything else (Correct answer)
- Allowing all traffic by default
- Blocking traffic based on IP reputation only
Correct answer: Allowing only explicitly defined legitimate request patterns and blocking everything else
A positive security model whitelists acceptable request shapes and rejects any deviation, offering stronger protection than signature-only approaches.
CDN CDN Web Application Firewall & Bot Management 1
What is the primary purpose of a Web Application Firewall (WAF) deployed at the CDN edge?