SY0-701 Security Operations Practice Question
The web team is placing a public customer portal behind a control that can inspect HTTP requests, block malicious payloads such as SQL injection and cross-site scripting, and still allow legitimate application traffic without rewriting the app. Which control should they deploy?
⚠ Common exam trap
Many candidates confuse an IDS (which only detects) with a WAF (which actively blocks), or they mistakenly think a DLP appliance can filter web application attacks, when in fact DLP focuses on data in motion or at rest, not on application-layer payload inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A WAF in front of the application.
A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at the application layer (Layer 7), filtering out malicious payloads like SQL injection and cross-site scripting (XSS) while allowing legitimate requests to pass through. Unlike an IDS, a WAF operates inline and can actively block threats without requiring modifications to the application code, making it the ideal choice for protecting a public-facing web portal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An IDS placed on the same network segment as the web server.
Why it's wrong here
An IDS on the same network segment as the web server operates in passive monitor mode, copying traffic and matching it against known attack signatures. It can flag SQL injection or XSS patterns, but it is not inline, so it cannot stop the request from reaching the application before damage occurs. Because it relies on post-host analysis, a skilled attacker can evade detection by splitting payloads or using encrypted traffic the IDS never decrypts.
- ✗
A DLP appliance between users and the portal.
Why it's wrong here
A DLP appliance positioned between users and the portal is designed to inspect outbound data in the clear or via brokers to prevent leakage of PII, credit cards, or proprietary files. It lacks web application layer parsing and does not evaluate HTTP request parameters for malicious syntax, making it completely ineffective against SQLi or XSS payloads. Moreover, DLP is typically deployed at egress points, not as a reverse proxy, so it would not even see the raw application-layer requests in the expected deployment.
- ✓
A WAF in front of the application.
Why this is correct
A web application firewall is built to inspect HTTP and HTTPS traffic at the application layer and block common web attacks such as SQL injection and XSS. It can protect a public portal without requiring code changes, making it a practical compensating control while the application team improves secure coding. This is the best fit when the goal is to stop malicious web payloads before they reach the app.
- ✗
A NAC solution on the switch ports feeding the portal.
Why it's wrong here
A NAC solution on switch ports feeding the portal checks device posture—patches, antivirus, or certificates—before allowing network access. It operates at Layers 2/3 and enforces endpoint admission, but it does not inspect the content of web requests, so a fully compliant and admitted device could still send malformed HTTP payloads carrying SQL injection. NAC might block an unmanaged laptop, but it cannot distinguish a legitimate browse from a malicious request that originates from an authorized device.
Visual reference
Go deeper
Related to this question
Learn chapter
Application Whitelisting and Control
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web team is moving a customer portal behind a new inspection device. They need something that can examine HTTP requests, block malicious patterns like injection attempts, and still allow normal browsing. Which control is most appropriate?
medium- A.IDS, because it alerts on suspicious traffic without affecting application delivery.
- ✓ B.WAF, because it understands web requests and can block malicious application-layer traffic.
- C.DLP, because it can stop sensitive data from being posted to the portal.
- D.NAC, because it verifies whether devices are allowed onto the network.
Why B: A WAF (Web Application Firewall) is the correct choice because it operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic. It can parse web requests, identify malicious patterns such as SQL injection or XSS payloads, and block them while allowing legitimate traffic to pass through to the customer portal.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.