CISSP Software Development Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Encrypting all web traffic

  Why it's wrong here

  Encrypting all web traffic is primarily handled by Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protocols, which operate at lower layers of the OSI model to establish secure communication channels. While a Web Application Firewall (WAF) can inspect encrypted traffic after it has been decrypted by a TLS/SSL offloader or proxy, its fundamental role is not to perform the encryption or decryption itself. The WAF's focus is on analyzing the content of the traffic for malicious patterns, not establishing the secure tunnel.

• ✓

  Filtering malicious HTTP traffic

  Why this is correct

  Filtering malicious HTTP traffic is the core and primary purpose of a Web Application Firewall (WAF). A WAF inspects incoming HTTP/HTTPS requests and outgoing responses at the application layer (Layer 7) for signatures and behaviors indicative of common web attacks, such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. By analyzing the content, headers, and parameters, the WAF can block or alert on malicious requests before they reach the web application, thereby protecting it from exploitation.

• ✗

  Managing user authentication

  Why it's wrong here

  Managing user authentication is a function typically handled by the web application itself or a dedicated identity provider (IdP) like OAuth, SAML, or LDAP. These systems are responsible for verifying user credentials, managing sessions, and enforcing access controls based on user identities. While a WAF can protect the authentication mechanisms from attacks like brute-force attempts or credential stuffing, it does not perform the actual authentication or authorization process for users accessing the application.

• ✗

  Performing vulnerability scanning

  Why it's wrong here

  Performing vulnerability scanning is a distinct security control that involves actively probing applications and systems to identify security weaknesses and misconfigurations. Vulnerability scanners are tools designed to discover potential flaws, whereas a Web Application Firewall (WAF) is a defensive control that mitigates attacks targeting those vulnerabilities, whether known or unknown. A WAF acts as a shield against exploitation, rather than a tool for discovering the underlying weaknesses within the application code or infrastructure.

Go deeper

Related to this question