How to Block SQL Injection Attacks with FortiWeb WAF Signatures
A company uses FortiWeb to protect its web application. They want to block SQL injection attempts. Which FortiWeb feature should be configured to inspect HTTP requests for malicious SQL patterns?
Quick Answer
The answer is Web Application Firewall (WAF) Signatures. FortiWeb uses these pre-configured signatures to inspect HTTP requests for malicious SQL patterns, comparing incoming data against a regularly updated database of known injection strings. This allows the appliance to block SQL injection attacks at the application layer before they reach the backend database. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of signature-based detection versus anomaly-based or machine learning methods—a common trap is confusing WAF signatures with IPS signatures, which operate at the network layer. Remember that for web-specific threats like SQL injection, you must enable the dedicated WAF signature set under the Web Protection profile. A useful memory tip: think of WAF signatures as a "bouncer checking IDs at the door" for every HTTP request, while IPS signatures are more like a "patrol officer watching the street."
⚠ Common exam trap
Many exam-takers confuse 'HTTP Protocol Constraint' (which only checks protocol compliance) with content inspection features like WAF Signatures, leading them to select option C instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web Application Firewall (WAF) Signatures
FortiWeb's WAF Signatures (option B) are specifically designed to inspect HTTP request payloads for known attack patterns, including SQL injection signatures. This feature uses a regularly updated signature database to match malicious SQL syntax (e.g., UNION, OR 1=1) within GET/POST parameters, cookies, or headers, making it the correct choice for blocking SQL injection attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
URL Access Rule
Why it's wrong here
URL Access Rules match request paths and hostnames to allow or deny access, not payload content, so SQL metacharacters inside parameters pass through uninspected. It is tempting because URL access control is genuinely used to restrict which paths are reachable, but SQL injection requires a signature-based inspection profile.
- ✓
Web Application Firewall (WAF) Signatures
Why this is correct
WAF signatures match known SQL injection patterns such as UNION SELECT and tautologies within HTTP request parameters, blocking those requests before they reach the application. This satisfies the requirement to inspect requests for malicious SQL patterns, which generic firewall rules cannot parse.
- ✗
HTTP Protocol Constraint
Why it's wrong here
HTTP Protocol Constraints enforce RFC compliance on headers, methods and body length, rejecting malformed protocol traffic rather than attack payloads. It is tempting because protocol hardening is genuinely used against request smuggling and malformed requests, but SQL injection detection needs signature matching, not protocol validation.
- ✗
IP List
Why it's wrong here
IP Lists permit or block traffic by source address, so an attacker using a permitted address still delivers SQL payloads unchallenged. It is tempting because IP reputation blocking is genuinely used against known malicious sources, but SQL injection inspection must examine request content, not network origin.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses FortiGate as a web application firewall (WAF) to protect a public web server. The security team wants to block SQL injection attacks. Which WAF signature category should the administrator enable?
medium- A.Server-Side Request Forgery
- B.Command Injection
- ✓ C.SQL Injection
- D.Cross-Site Scripting
Why C: SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.
Variation 2. A company uses FortiWeb as a reverse proxy for their web application. They want to protect against SQL injection attacks. Which FortiWeb feature should be configured?
medium- ✓ A.Enable 'SQL Injection Prevention' in the Web Protection Profile
- B.Enable 'IPS Sensor' with SQL injection signatures
- C.Use the FortiGate WAF profile instead
- D.Configure a custom HTTP header validation rule
Why A: FortiWeb's Web Protection Profile includes a dedicated 'SQL Injection Prevention' module that uses signature-based and behavioral analysis to detect and block SQL injection attempts at the application layer. This is the correct feature because FortiWeb is a web application firewall (WAF) designed specifically for HTTP/HTTPS traffic, and SQL injection protection is a core WAF function, not a general IPS or network-layer feature.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.