How to Block SQL Injection Attacks with FortiWeb WAF Signatures
A company uses FortiWeb to protect its web application. They want to block SQL injection attempts. Which FortiWeb feature should be configured to inspect HTTP requests for malicious SQL patterns?
Quick Answer
The answer is Web Application Firewall (WAF) Signatures. FortiWeb uses these pre-configured signatures to inspect HTTP requests for malicious SQL patterns, comparing incoming data against a regularly updated database of known injection strings. This allows the appliance to block SQL injection attacks at the application layer before they reach the backend database. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of signature-based detection versus anomaly-based or machine learning methods—a common trap is confusing WAF signatures with IPS signatures, which operate at the network layer. Remember that for web-specific threats like SQL injection, you must enable the dedicated WAF signature set under the Web Protection profile. A useful memory tip: think of WAF signatures as a "bouncer checking IDs at the door" for every HTTP request, while IPS signatures are more like a "patrol officer watching the street."
⚠ Common exam trap
Many exam-takers confuse 'HTTP Protocol Constraint' (which only checks protocol compliance) with content inspection features like WAF Signatures, leading them to select option C instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web Application Firewall (WAF) Signatures
FortiWeb's WAF Signatures (option B) are specifically designed to inspect HTTP request payloads for known attack patterns, including SQL injection signatures. This feature uses a regularly updated signature database to match malicious SQL syntax (e.g., UNION, OR 1=1) within GET/POST parameters, cookies, or headers, making it the correct choice for blocking SQL injection attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
URL Access Rule
Why it's wrong here
URL Access Rules control access based on URL patterns, not content inspection.
- ✓
Web Application Firewall (WAF) Signatures
Why this is correct
WAF Signatures include pre-defined rules for SQL injection, XSS, etc.
- ✗
HTTP Protocol Constraint
Why it's wrong here
Protocol constraints check HTTP compliance, not specific attack patterns.
- ✗
IP List
Why it's wrong here
IP List blocks by IP address, not payload patterns.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses FortiGate as a web application firewall (WAF) to protect a public web server. The security team wants to block SQL injection attacks. Which WAF signature category should the administrator enable?
medium- A.Server-Side Request Forgery
- B.Command Injection
- ✓ C.SQL Injection
- D.Cross-Site Scripting
Why C: SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.
Variation 2. A company uses FortiWeb as a reverse proxy for their web application. They want to protect against SQL injection attacks. Which FortiWeb feature should be configured?
medium- ✓ A.Enable 'SQL Injection Prevention' in the Web Protection Profile
- B.Enable 'IPS Sensor' with SQL injection signatures
- C.Use the FortiGate WAF profile instead
- D.Configure a custom HTTP header validation rule
Why A: FortiWeb's Web Protection Profile includes a dedicated 'SQL Injection Prevention' module that uses signature-based and behavioral analysis to detect and block SQL injection attempts at the application layer. This is the correct feature because FortiWeb is a web application firewall (WAF) designed specifically for HTTP/HTTPS traffic, and SQL injection protection is a core WAF function, not a general IPS or network-layer feature.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.