CND Network Attacks And Defense Strategies Practice Question
An organization's security engineer is configuring a Web Application Firewall (WAF) to protect against common web attacks. Which TWO attack types should the WAF rules be specifically tuned to detect and block? (Choose TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-Site Scripting (XSS) by inspecting parameters for malicious injected client-side script tags.
WAFs are specifically designed to inspect HTTP traffic and mitigate web vulnerabilities such as Cross-Site Scripting (XSS) and SQL Injection (SQLi).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP cache poisoning by validating ARP reply frames against DHCP snooping bindings.
Why it's wrong here
ARP poisoning is a local subnet Layer 2 attack handled by switch security features.
- ✓
Cross-Site Scripting (XSS) by inspecting parameters for malicious injected client-side script tags.
Why this is correct
WAF inspection blocks malicious script injections in HTTP requests.
- ✗
BGP route hijacking by verifying autonomous system path announcements.
Why it's wrong here
BGP routing attacks occur at Layer 3/Network core, well outside WAF inspection capabilities.
- ✗
DHCP starvation attacks by monitoring DHCP Discover message rates on edge switches.
Why it's wrong here
DHCP starvation is a Layer 2 switch port attack, not a web application vulnerability.
- ✓
SQL Injection (SQLi) by parsing request parameters for database command syntax.
Why this is correct
WAFs analyze parameters to detect and block SQL injection attempts.
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.