An administrator has attached a WAF Policy to their Virtual Service and starts getting reports from users that they are receiving a "403 Forbidden" error when trying to reach their application…

Question

Options

• AThe WAF Policy is in enforcement mode.
• BThe WAF Policy has learning mode disabled.
• CThe WAF Policy signatures are disabled.
• DThe WAF Policy is in detection mode.

• A
  10% (3)
• B
  83% (24)
• C
  3% (1)
• D
  3% (1)

Explanation

Option B is correct because when learning mode is disabled on a WAF Policy, the system has no baseline understanding of what constitutes normal, legitimate traffic for that application. Without this learned context, the WAF applies its pre-configured signatures rigidly, causing false positives - flagging and blocking legitimate user requests with 403 errors. Learning mode allows the WAF to observe real traffic patterns and tune its rules accordingly, reducing unintended blocking.

Why the distractors are wrong:

• A (Enforcement mode): Enforcement mode is the expected operational state - it's what makes a WAF useful. On its own, it doesn't cause excessive 403s; that's only a problem when rules aren't properly tuned (i.e., learning hasn't occurred).
• C (Signatures disabled): Disabled signatures mean fewer rules are being checked, which would reduce blocking, not cause 403 errors.
• D (Detection mode): Detection mode only logs violations - it never blocks traffic, so users would never receive 403 errors from it.

Memory tip: Think of learning mode as the WAF's "training wheels" - without it, the WAF enforces rules blindly without knowing what's normal for your app. "No Learning = No Leniency = False Positives = 403s."

No community discussion yet for this question.