ISC2 CC Network Security Practice Question
A company deploys a device that inspects HTTP and HTTPS traffic to block SQL injection and cross-site scripting attacks. This device is best described as a:
⚠ Common exam trap
The trap is confusing a WAF with a network IPS or stateful firewall; the exam tests that only a WAF is purpose-built for HTTP/HTTPS application-layer attack prevention like SQLi and XSS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web application firewall (WAF)
A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic and block application-layer attacks like SQL injection and cross-site scripting (XSS). It operates at Layer 7 and understands web protocols, making it the correct choice for protecting web applications from these threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stateful firewall
Why it's wrong here
A stateful firewall tracks connection state (TCP sessions, established flows) and permits or denies packets on that basis; it does not parse HTTP payloads for SQL injection or XSS signatures. It is tempting because stateful inspection is the foundation of perimeter filtering, and it would be the right answer if the question asked about controlling traffic flows between zones.
- ✓
Web application firewall (WAF)
Why this is correct
A web application firewall inspects HTTP and HTTPS requests, applying signatures and rules to block SQL injection and cross-site scripting. It operates at the application layer, distinguishing it from network firewalls that filter by IP, port, or protocol.
- ✗
Honeypot
Why it's wrong here
A honeypot is a decoy system that lures and observes attackers; it neither inspects production HTTP and HTTPS traffic nor blocks SQL injection or cross-site scripting. It is tempting because it detects malicious activity, which is correct for threat intelligence and early-warning deception, not inline web attack prevention.
- ✗
Network-based IPS
Why it's wrong here
NIPS inspects general network traffic, not specifically web applications.
Go deeper
Related to this question
Key term
XSS
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Key term
Cross-site scripting
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, often to steal data or hijack sessions.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.