easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A company's IDS generated an alert for a…
A company's IDS generated an alert for a potential SQL injection attack on a web application. The security analyst reviews the alert and confirms that the application is protected by a Web Application Firewall (WAF) that filters SQL injection attempts. Which of the following is the best course of action?
⚠ Common exam trap
CompTIA often tests the misconception that any IDS alert requires immediate action, when in fact the presence of compensating controls like a WAF means the alert may be a false positive or a blocked attempt that does not require intervention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No action needed
The WAF is already configured to filter SQL injection attempts, so the alert from the IDS does not indicate a successful attack. Since the WAF is actively blocking the malicious payload, no additional action is required. The IDS alert is a normal byproduct of the WAF's filtering, and the security analyst should confirm that the WAF is functioning correctly rather than taking unnecessary steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the source IP
Why it's wrong here
Blocking the source IP address at a network level is an overly aggressive response for an attack already mitigated by a Web Application Firewall (WAF). This action risks impacting legitimate users who might share the same IP or be behind a NAT, leading to service disruption. Furthermore, it is unnecessary because the WAF has already successfully filtered the malicious SQL injection attempt, demonstrating that the primary application-layer defense mechanism functioned as designed.
- ✓
No action needed
Why this is correct
The alert from the Intrusion Detection System (IDS) indicates that a SQL injection attempt was detected, but the Web Application Firewall (WAF) successfully protected the application. This scenario demonstrates that the layered security controls are functioning effectively, with the WAF acting as a preventative control at the application layer. Since the WAF successfully blocked the malicious traffic, the application remains secure, and no immediate manual intervention is required for this specific incident.
- ✗
Disable the Web Application Firewall
Why it's wrong here
Disabling the Web Application Firewall (WAF) would be a critical security misstep, as it would remove the primary defense mechanism specifically designed to protect against application-layer attacks like SQL injection. This action would immediately expose the application to the very vulnerabilities the WAF is configured to mitigate, drastically increasing the risk of a successful compromise. Such a decision is antithetical to maintaining a robust security posture and would leave the system highly vulnerable.
- ✗
Create a custom signature
Why it's wrong here
Creating a custom signature for SQL injection is generally unnecessary when a Web Application Firewall (WAF) is already effectively filtering and blocking such attempts using its existing, robust rule sets. Custom signatures are typically reserved for novel, polymorphic, or highly targeted attacks that evade standard detection, not for common attack vectors already handled by established security controls. Implementing redundant or poorly optimized custom rules could introduce performance overhead or false positives without enhancing the already effective protection provided by the WAF.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.