SY0-701 Security Operations Practice Question
A company is placing a customer-facing web application behind a new security control. The team wants to block malicious HTTP requests such as injection attempts before they reach the application server, with minimal code changes to the app itself. Which control is the best fit?
⚠ Common exam trap
It's easy for candidates to confuse a WAF with a network firewall or NAC, thinking any 'security control' placed in front of a server can block application-layer attacks, but only a WAF operates at Layer 7 with HTTP-specific inspection capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web application firewall (WAF) in front of the application.
A web application firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7), blocking malicious payloads such as SQL injection and cross-site scripting (XSS) before they reach the web server. It operates without requiring changes to the application code, making it the ideal choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network access control (NAC) at the switch port.
Why it's wrong here
Network access control (NAC) at the switch port is a pre- and post-admission security technology that enforces endpoint policy compliance, such as antivirus updates or patch levels, before granting network access. However, it operates at Layers 2 and 3 and does not inspect Layer 7 HTTP payloads, so it cannot block application-layer attacks like SQL injection or cross-site scripting. Once a device is admitted, NAC does not filter inbound web requests, making it ineffective for protecting a customer-facing web application.
- ✓
Web application firewall (WAF) in front of the application.
Why this is correct
A web application firewall (WAF) is purpose-built to protect web applications by inspecting HTTP/HTTPS traffic at the application layer and filtering malicious requests using signature-based and behavioral rules. It understands web protocols, allowing it to block common exploits such as SQL injection, cross-site scripting (XSS), and CSRF without requiring changes to application code. Deploying a WAF inline in front of the application provides real-time, proactive filtering of inbound requests before they reach the server, making it the correct control for this scenario.
- ✗
Data loss prevention (DLP) on the email gateway.
Why it's wrong here
Data loss prevention (DLP) at the email gateway is designed to inspect email content and attachments to detect unauthorized transmission of sensitive data, such as PII, credit card numbers, or intellectual property, and then enforce policy actions like blocking or encryption. Its detection engines are tuned for data patterns and context, not for attack signatures or malicious HTTP payloads. Therefore, email-gateway DLP would neither monitor web traffic nor defend the web application against application-layer exploits, so it is the wrong tool here.
- ✗
Endpoint detection and response (EDR) on the web server only.
Why it's wrong here
Endpoint detection and response (EDR) on the web server uses a host-based agent to monitor system activities, processes, and file integrity to detect intrusions and malicious behavior after they occur or while executing. It can help identify a compromised server and contain malware, but it does not provide inline filtering of inbound HTTP requests at the network boundary, so malicious payloads reach the application before the agent ever sees them. This is detection-reliant rather than prevention-oriented, and it lacks the protocol-aware inspection of a dedicated web application firewall.
Go deeper
Related to this question
Learn chapter
Wireless Security Protocols
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Web Application Firewall
A Web Application Firewall (WAF) is a security tool that monitors, filters, and blocks HTTP traffic to and from a web application to protect it from common attacks.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.