Courseiva
SecurityhardMultiple ChoiceObjective-mapped

CV0-004 Web Application Firewall (WAF) Practice Question

A company running a critical web application wants to protect against SQL injection and cross-site scripting attacks. The application is behind a load balancer. Which type of service should be deployed to provide this protection?

⚠ Common exam trap

It's easy for candidates to confuse a web application firewall with a DDoS protection service, thinking the latter provides application-layer attack protection. However, DDoS protection focuses on volumetric attacks while a WAF handles web-specific exploits like SQL injection and XSS.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Web application firewall (WAF)

A web application firewall (WAF) is designed to protect web applications from common web exploits like SQL injection and cross-site scripting. It can be integrated with load balancers to inspect HTTP/HTTPS traffic and filter malicious requests based on customizable rules. This makes it the correct choice for the described threat scenario.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Network firewall

    Why it's wrong here

    A network firewall filters traffic based on IP addresses and ports but does not inspect application-layer payloads for SQL injection or XSS.

  • DDoS protection service

    Why it's wrong here

    A DDoS protection service mitigates volumetric attacks but does not provide application-layer filtering for web exploits.

  • Intrusion detection system

    Why it's wrong here

    An intrusion detection system monitors for suspicious activity but may not have the granularity or rule sets specifically for web application attacks.

  • Web application firewall (WAF)

    Why this is correct

    A web application firewall (WAF) inspects HTTP/HTTPS traffic and can block SQL injection and XSS attacks, making it the correct choice.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.