mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Is configuring a web application firewall (WAF)…
A security engineer is configuring a web application firewall (WAF) for an e-commerce site. The application uses JSON APIs for all transactions. Which WAF mode provides the best protection against injection attacks while minimizing false positives?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Positive security model with strict API schema validation
Positive security model with strict API schema validation. For a web application that uses JSON APIs, a positive security model (whitelist-based) is ideal because it explicitly defines what is allowed, such as valid JSON schema structures, data types, and value ranges. This provides strong protection against injection attacks by rejecting any input that does not conform to the allowed schema, significantly reducing false positives compared to negative models that rely on blocking known attack patterns. Option A (Anomaly detection and learning mode) can adapt but may not be as precise for structured APIs. Option C (Passive mode) only monitors without blocking. Option D (Negative security model) can block common attacks but risks false positives and may miss novel injection vectors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Anomaly detection and learning mode
Why it's wrong here
Learns normal traffic but may allow attack variations initially.
- ✓
Positive security model with strict API schema validation
Why this is correct
Only allows traffic that matches expected schema, effectively preventing injections.
- ✗
Passive mode for monitoring only
Why it's wrong here
No active protection against attacks.
- ✗
Negative security model with a large rule set
Why it's wrong here
Blocks known patterns but may block legitimate traffic.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.