CCSP Cloud Application Security Practice Question
A cloud security team is implementing a Web Application Firewall (WAF) for a public-facing web application. The application uses a REST API with JSON payloads. Which of the following is the WAF's primary benefit?
⚠ Common exam trap
ISC2 often tests the distinction between Layer 7 (application) and Layer 3/4 (network) security controls, so candidates mistakenly choose network-layer DDoS protection (Option B) because they confuse WAF with a general-purpose firewall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inspecting HTTP traffic for malicious payloads
A WAF operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic for malicious payloads such as SQL injection, cross-site scripting (XSS), and JSON-based attacks. For a REST API using JSON, the WAF can parse and validate the JSON structure, blocking malformed or malicious payloads before they reach the application server. This is the primary benefit because it directly protects the application logic from web-based exploits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Scanning for data loss prevention (DLP) violations
Why it's wrong here
A WAF inspects HTTP/HTTPS request patterns to block injection and payload attacks; it does not inspect data content for exfiltration, which is the role of a DLP tool monitoring data flows. DLP would be the right control when the requirement is preventing sensitive data leaving the organisation.
- ✗
Preventing network-layer DDoS attacks
Why it's wrong here
Volumetric and network-layer DDoS absorption is handled by scrubbing centres and CDN edge capacity, not by a WAF parsing application requests. A WAF targets layer 7 attacks such as SQL injection; DDoS mitigation is correct when the requirement is surviving traffic floods.
- ✗
Encrypting data in transit between client and server
Why it's wrong here
TLS terminates encryption in transit between client and server; a WAF operates on decrypted HTTP requests to filter malicious payloads. Encryption is the correct control when the requirement is confidentiality of data on the wire, not attack filtering.
- ✓
Inspecting HTTP traffic for malicious payloads
Why this is correct
A WAF operates at the application layer, parsing HTTP requests and responses to detect and block malicious payloads such as SQL injection or cross-site scripting before they reach the REST API, directly satisfying the requirement to protect the public-facing JSON-based application.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.