Which file type will the default WAF Profile bypass for inspection?

Question

Options

• Ayml
• B.txt
• Cico
• D.exe

• A
  2% (1)
• B
  2% (1)
• C
  93% (56)
• D
  3% (2)

Explanation

Option C (.ico) is correct because icon files are static image assets (typically website favicons) that default WAF profiles exclude from deep inspection - they contain no executable logic, scripts, or user-supplied data, making them extremely low-risk and costly to inspect at scale.

Why the distractors are wrong:

• A (.yml) - YAML files can carry configuration data or be user-uploaded, so they remain subject to inspection.
• B (.txt) - Plain text files can contain malicious payloads (e.g., path traversal strings, injection attempts) and are inspected.
• D (.exe) - Executables are among the highest-risk file types; no sensible default profile would skip them.

Memory tip: Think "ICO = Ignored by default." Icon files are tiny, read-only branding images fetched millions of times per day - inspecting them wastes cycles with zero security gain, so vendors pre-whitelist them. If you see a static, non-interactive image format in a WAF bypass list, .ico is the classic example.

No community discussion yet for this question.