ISC2 CC Network Security Practice Question
An IT administrator wants to inspect HTTP traffic for malicious payloads such as SQL injection. Which network security device is most appropriate?
⚠ Common exam trap
The trap is choosing IDS or IPS because they sound like security devices that inspect traffic; candidates must remember that a WAF is the specialized tool for HTTP application-layer attacks like SQL injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WAF
A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic and block malicious payloads such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks. It operates at the application layer (Layer 7) and can enforce custom rules based on HTTP request contents. An IDS or IPS may detect or block some attacks but is not purpose-built for web application protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IDS
Why it's wrong here
An IDS passively copies traffic and raises alerts; it cannot inspect inline and block the SQL injection payloads the administrator needs stopped. It is tempting because signature-based detection genuinely identifies malicious HTTP patterns, and an IDS would be the right choice when the requirement is monitoring and alerting rather than prevention.
- ✓
WAF
Why this is correct
A web application firewall inspects HTTP/HTTPS request payloads at layer 7, matching signatures for SQL injection, cross-site scripting and similar attacks. It satisfies the stem's requirement to inspect HTTP traffic for malicious payloads, which a network firewall cannot decode.
- ✗
Honeypot
Why it's wrong here
A honeypot is a decoy system that lures and observes attackers; it does not sit in the HTTP path inspecting payloads such as SQL injection. It is tempting because honeypots do capture attacker behaviour and payloads, and would be correct when the goal is early-warning detection or threat intelligence rather than inline inspection.
- ✗
IPS
Why it's wrong here
An IPS is inline and can block malicious HTTP payloads, but the requirement is inspection, which an IDS performs by monitoring traffic and alerting without sitting in the forwarding path. It tempts because IPS offers stronger enforcement, and would be correct if the goal were prevention rather than detection.
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Network Access Control
Network Access Control is a security solution that enforces policies to control which devices and users can connect to a network, ensuring only authorized and compliant endpoints gain access.
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.