SY0-701 Security Operations Practice Question
A public web application is seeing bursts of requests that contain SQL metacharacters, encoded script tags, and attempts to POST to administrative endpoints. The team wants a control that can inspect HTTP traffic and block the malicious requests before they reach the app. What should be deployed?
⚠ Common exam trap
Test-takers frequently confuse a WAF with a network firewall or an IDS/IPS, but the question specifically mentions HTTP traffic inspection and blocking of application-layer attacks (SQLi, XSS), which is the precise domain of a WAF, not a general network firewall or host-based EDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A web application firewall in front of the application
A web application firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), analyzing request payloads for SQL metacharacters, encoded script tags (XSS), and unauthorized POST attempts to administrative endpoints. By deploying a WAF in front of the web application, malicious traffic is filtered and blocked before it reaches the application server, providing a proactive security control against common web attacks such as SQL injection and cross-site scripting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A web application firewall in front of the application
Why this is correct
A web application firewall (WAF) inspects inbound HTTP/S traffic at Layer 7, parsing request bodies, headers, and query strings for attack signatures such as SQL injection or cross-site scripting payloads. Deployed inline in front of the application, it can filter and block malicious bursts before the web server processes them, and many WAFs also provide rate limiting and bot mitigation to handle traffic spikes. This is precisely the control designed to stop application-layer injection attempts.
- ✗
An endpoint detection and response agent on the web server only
Why it's wrong here
An endpoint detection and response (EDR) agent resides on the web server and monitors host-level activity such as process execution, file modifications, and system calls. It is not positioned inline within the network path, so it cannot inspect each HTTP request as it arrives or reject malicious payloads before they reach the application; at best it would alert to a successful compromise after the fact, making it ineffective at blocking the initial burst of attack traffic.
- ✗
A data loss prevention rule on the email gateway
Why it's wrong here
A data loss prevention (DLP) rule enforced at the email gateway scans message content and attachments for sensitive data like credit card numbers or social security numbers, preventing unauthorized disclosure via email. It has no awareness of HTTP/S web traffic and is completely disconnected from the application's request path, so it cannot detect or block SQL injection, XSS, or other web-based attack patterns in the reported bursts.
- ✗
A network access control system for user authentication
Why it's wrong here
Network access control (NAC) authenticates endpoints and enforces security policy at the network access layer, determining whether a device is compliant before allowing it onto the network. It does not operate at the application layer and lacks any deep packet inspection capability for HTTP payloads, so while it might authenticate a user, it cannot distinguish a legitimate request from an attack, nor can it filter the burst of malicious web traffic.
Visual reference
Go deeper
Related to this question
Learn chapter
Wireless Security Protocols
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.