CDN Web Application Firewall & Bot Management Flashcards

What is the primary purpose of a Web Application Firewall (WAF) deployed at the CDN edge?

Answer: To inspect and filter HTTP/HTTPS traffic against application-layer attacks

A WAF at the CDN edge inspects HTTP/HTTPS requests and blocks application-layer attacks such as SQLi, XSS, and CSRF before they reach the origin.

Which OWASP Top 10 threat is most commonly blocked by a CDN WAF rule targeting user-supplied input in URL parameters?

Answer: SQL Injection

SQL Injection attacks typically embed malicious SQL code in URL parameters or form fields, which WAF rules detect and block at the edge.

A CDN WAF is configured in 'monitor' mode. What is the effect on malicious traffic?

Answer: Traffic is allowed but logged for analysis

Monitor (or detection-only) mode logs rule matches without blocking, allowing teams to tune rules before enabling enforcement.

What CDN feature allows operators to challenge suspected bots with a JavaScript-based browser check before serving content?

Answer: Bot challenge / managed challenge

A managed bot challenge presents a transparent JavaScript or CAPTCHA challenge to verify that the client is a real browser, not an automated script.

Which metric best indicates that a WAF rule is producing false positives in production?

Answer: Spike in legitimate user 403 errors after rule deployment

A surge in 403 Forbidden responses for known-good users immediately after a rule change strongly indicates the rule is incorrectly blocking legitimate traffic.

What is a 'positive security model' WAF approach?

Answer: Allowing only explicitly defined legitimate request patterns and blocking everything else

A positive security model whitelists acceptable request shapes and rejects any deviation, offering stronger protection than signature-only approaches.