A Web Application Firewall (WAF) should be treated as a replacement for secure query construction.
Answer
false
Explanation
### Why this is right
A WAF can intercept and filter some malicious requests, but it does not correct vulnerable application code. Secure query construction, especially parameterized queries, addresses the underlying cause.
### The concept
A defense in depth approach uses multiple safeguards. A WAF can add a layer at the web traffic boundary, while secure coding prevents input from altering database commands. Logging and testing help find attempts and weaknesses that other controls miss.
### The other options
- **True**: this is incorrect because a filter may fail to recognize a request, and vulnerable code remains exploitable through other paths.
### Terms
- **WAF**: Web Application Firewall, a control that inspects and filters web requests.
- **Parameterized query**: a query design that keeps user values separate from SQL instructions.
### Remember
A filtering layer can supplement secure code, but cannot replace it.
Related Questions
- Regular security audits and penetration tests can help identify and fix application weaknesses before attackers exploit them.(basic)
- In blind Structured Query Language (SQL) injection, the attacker cannot directly see the result and instead infers information from application behavior.(basic)
- A database account should have only the permissions required for its task. This is the principle of _____.(basic)
- A database-backed application needs to stop showing detailed database errors to ordinary users while retaining information for investigation. Which approach best matches the lesson?(intermediate)
- What is the main reason to avoid constructing database statements dynamically from unchecked user input?(basic)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free