Computer Security Applicationsadvanced
A team proposes using only a Web Application Firewall (WAF) to defend a vulnerable database-backed login form. Evaluate this proposal and recommend a layered approach using lesson controls.
Answer
A WAF can filter malicious requests but should not be the only defense because it does not repair unsafe query construction. The team should use parameterized queries, validate input, restrict the database account using least privilege, handle and log errors appropriately, monitor suspicious activity, and conduct security testing. These controls provide prevention, impact limitation, detection, and verification.
Explanation
### What a good answer covers
- Explain that a WAF filters traffic but does not correct vulnerable application code.
- Recommend parameterized queries and input validation to reduce injection risk.
- Recommend least privilege to limit possible database actions.
- Include safe error handling, logging, monitoring, and authorized security testing.
- Explain that the controls have different roles and should be layered.
### Terms
- **WAF**: Web Application Firewall, a control that inspects and filters web requests.
- **Parameterized query**: a query design that separates user values from instructions.
- **Least privilege**: limiting permissions to those needed for a task.
### Remember
A filter is one layer, not a substitute for fixing vulnerable code.
Related Questions
- A database-backed application needs to stop showing detailed database errors to ordinary users while retaining information for investigation. Which approach best matches the lesson?(intermediate)
- Regular security audits and penetration tests can help identify and fix application weaknesses before attackers exploit them.(basic)
- A Web Application Firewall (WAF) should be treated as a replacement for secure query construction.(basic)
- A database account should have only the permissions required for its task. This is the principle of _____.(basic)
- In blind Structured Query Language (SQL) injection, the attacker cannot directly see the result and instead infers information from application behavior.(basic)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free