mediumMultiple SelectObjective-mapped
CISSP Practice Question: A security analyst is evaluating a web…
A security analyst is evaluating a web application firewall (WAF). Which TWO features are most critical for preventing common web attacks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Signature-based detection.
Signature-based detection catches known attack patterns; behavioral analysis identifies anomalies and unknown attacks. SSL inspection is for decryption, not prevention. Rate limiting is for availability. Virtual patching is a specific technique that is less critical than core detection engines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Virtual patching.
Why it's wrong here
Virtual patching is a temporary security measure applied at the WAF level to protect against known vulnerabilities in web applications until a permanent fix can be deployed. While it prevents exploitation by filtering malicious traffic targeting specific flaws, it is a reactive mitigation strategy rather than a primary detection mechanism for general web application attacks. It acts as a shield against *known* vulnerabilities, not a broad detection engine.
- ✓
Signature-based detection.
Why this is correct
Signature-based detection is a fundamental WAF capability that identifies malicious traffic by comparing incoming requests against a database of known attack patterns or "signatures." This method is highly effective at blocking common and well-documented threats, such as specific SQL injection queries, cross-site scripting (XSS) payloads, or directory traversal attempts. It relies on pre-defined rules to pinpoint and prevent known attack vectors.
- ✗
SSL inspection.
Why it's wrong here
SSL inspection, also known as TLS decryption, is a process where the WAF decrypts encrypted web traffic (HTTPS) to allow its security engines to examine the content for malicious activity. While crucial for enabling the WAF's detection capabilities to see inside encrypted payloads, SSL inspection itself is not a detection mechanism. It merely provides visibility into the traffic, allowing other WAF features like signature-based detection or behavioral analysis to function effectively.
- ✗
Rate limiting.
Why it's wrong here
Rate limiting is a WAF function designed to control the number of requests a client can make to a web application within a specified timeframe. Its primary purpose is to mitigate denial-of-service (DoS) attacks, brute-force attempts, and web scraping by blocking or challenging clients exceeding predefined thresholds. However, rate limiting does not analyze the content of individual requests for malicious payloads and therefore is not a direct detection mechanism for specific web application attacks like SQL injection or XSS.
- ✓
Behavioral analysis.
Why this is correct
Behavioral analysis, or anomaly detection, is a sophisticated WAF capability that establishes a baseline of normal web application traffic and user behavior. It then continuously monitors incoming requests for deviations from this established norm, such as unusual request patterns, unexpected parameters, or abnormal user activity. This method is particularly effective at identifying novel or zero-day attacks that do not have known signatures, as it focuses on the *unusualness* of the activity rather than specific attack patterns.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Web Application Firewall
A Web Application Firewall (WAF) is a security tool that monitors, filters, and blocks HTTP traffic to and from a web application to protect it from common attacks.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.