350-701 Web Application Firewall (WAF) Practice Question
An organization wants to protect their web application hosted on AWS from common exploits like SQL injection. Which Cisco service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco Firepower Next-Generation Firewall (NGFW)
Cisco Firepower Next-Generation Firewall (NGFW) with Intrusion Prevention System (IPS) can detect and block SQL injection attacks by inspecting HTTP traffic for malicious payloads. It provides application-layer protection through signature-based and behavioral analysis. The other options: ISE is for identity and access management, Stealthwatch for network visibility, and WSA is a web proxy without native WAF capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cisco Firepower Next-Generation Firewall (NGFW)
Why this is correct
Correct: Firepower NGFW with IPS (including virtual versions like FTDv) can detect and block SQL injection via deep packet inspection and IPS signatures.
- ✗
Cisco Identity Services Engine (ISE)
Why it's wrong here
Incorrect: Cisco ISE focuses on network access control and policy enforcement, not application-layer attack prevention.
- ✗
Cisco Stealthwatch
Why it's wrong here
Incorrect: Cisco Stealthwatch is for network traffic analysis and anomaly detection, not specifically for blocking web application attacks.
- ✗
Cisco Web Security Appliance (WSA)
Why it's wrong here
Incorrect: Cisco WSA is a web proxy that can filter URLs and scan for malware, but it does not include a dedicated web application firewall (WAF) and is not designed to block SQL injection attacks.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.