CDN Web Application Firewall & Bot Management Flashcards

What is the difference between a CDN-managed WAF ruleset and a custom WAF rule?

Answer: Managed rulesets are maintained by the CDN provider for known threats; custom rules are operator-defined for application-specific logic

Managed rulesets (e.g., OWASP CRS) are curated by the CDN provider and updated automatically, while custom rules address unique application behaviors or business logic.

Which header is commonly inspected by CDN WAF rules to detect cross-site request forgery (CSRF) attempts?

Answer: Origin and Referer headers

CSRF validation checks the Origin and Referer headers to ensure requests originate from the expected domain rather than a malicious third-party site.

A CDN offers 'bot score' as a field in its firewall rules. What does a low bot score typically indicate?

Answer: High probability of human traffic

In most CDN implementations, a low bot score indicates the traffic is likely human, while a high score suggests automation; conventions vary by vendor.

What is the purpose of a 'tarpit' or 'slow loris' defense in CDN bot management?

Answer: Intentionally slowing down suspected bot connections to waste their resources

A tarpit deliberately throttles suspected bot connections, tying up attacker resources and making large-scale scraping or attack campaigns economically infeasible.

Which CDN WAF deployment mode processes requests inline and can block attacks in real time before they reach the origin?

Answer: Inline / reverse proxy mode

In inline (reverse proxy) mode, all traffic passes through the WAF, enabling real-time blocking; out-of-band modes can only alert, not block.

A bot management system detects a distributed scraping attack sourced from thousands of residential IPs. Why is a simple IP blocklist ineffective?

Answer: The IPs rotate frequently and belong to legitimate ISPs, making blocking by IP indiscriminate and ineffective

Residential proxy networks rotate IPs constantly and share addresses with real users, so IP-based blocking causes high collateral damage without stopping the attack.