SSCP Network and Communications Security Practice Question
A company wants to protect its web servers from common web application attacks such as SQL injection and cross-site scripting. The security team decides to deploy a device that inspects HTTP traffic and blocks malicious requests. Which technology should they implement?
⚠ Common exam trap
The trap here is assuming that a network IPS or stateful firewall can fully protect against web application attacks, but they lack the deep HTTP inspection capabilities of a WAF.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web Application Firewall (WAF)
A Web Application Firewall (WAF) is purpose-built to inspect HTTP/HTTPS traffic and block application-layer attacks such as SQL injection and cross-site scripting. It understands web protocols and can apply rules to detect and mitigate these threats. Other options like IPS, stateful firewalls, or UTM appliances may offer some protection but are not as specialized or effective for web application security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Unified Threat Management (UTM) appliance
Why it's wrong here
A UTM appliance combines multiple security functions, including firewall, IPS, and sometimes WAF capabilities. While a UTM might include a WAF module, it is not exclusively focused on web application protection and may require additional configuration. The scenario asks for a specific technology to inspect HTTP traffic and block web attacks; a dedicated WAF is the most direct and specialized solution.
- ✗
Stateful firewall
Why it's wrong here
A stateful firewall tracks the state of network connections and allows or denies traffic based on ports, protocols, and connection state. It does not inspect the application-layer content of HTTP requests, so it cannot detect or block SQL injection or cross-site scripting. These attacks occur within legitimate HTTP traffic, which a stateful firewall would typically allow.
- ✓
Web Application Firewall (WAF)
Why this is correct
A WAF is specifically designed to inspect HTTP/HTTPS traffic and block attacks like SQL injection and cross-site scripting. It operates at the application layer and can enforce security policies based on request patterns. Deploying a WAF directly addresses the requirement to protect web servers from these common web application attacks, making it the correct choice.
- ✗
Intrusion Prevention System (IPS)
Why it's wrong here
An IPS monitors network traffic for malicious activity and can block intrusions, but it is not specialized for web application attacks. While some IPS products have web attack signatures, they generally operate at the network and transport layers and may not deeply inspect HTTP payloads. For comprehensive protection against SQL injection and XSS, a WAF is more appropriate and targeted.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.