The network operations team has found that the CPU utilization of their Service Engines has increased greatly since enabling Web Application Firewall (WAF), and this has been causing increased…

Question

Options

• AChange the WAF policy to detection mode
• BWrite Positive Security Model rules
• CIncrease the memory of the Service Engines
• DCreate allow list bypass rules
• EUse a different Core Rule Set

• A
  8% (3)
• B
  77% (30)
• C
  3% (1)
• D
  13% (5)

Explanation

Two complementary WAF performance strategies address the CPU bottleneck directly. Writing Positive Security Model (PSM) rules (B) defines explicitly what good traffic looks like, allowing the WAF to fast-path known-valid requests without running them through the expensive negative-security rule set - dramatically cutting per-request inspection cost. Using a different Core Rule Set (E) reduces CPU overhead by swapping to a smaller or more targeted ruleset, meaning fewer regex evaluations per request instead of processing the full, broad OWASP CRS for every packet.

The distractors fail for specific reasons: (A) Detection mode still inspects all traffic and evaluates all rules - it just logs instead of blocks, so CPU utilization stays high. (C) Adding memory doesn't help because the bottleneck is CPU cycles spent on rule evaluation, not RAM capacity. (D) Allow list bypass rules skip WAF inspection entirely for matched traffic, which is a security tradeoff/workaround rather than a WAF performance feature, and the question asks for ways to make WAF itself more efficient.

Memory tip: Think "PSM + Right Ruleset = Performance" - PSM speeds up known-good traffic, and a leaner ruleset speeds up unknown traffic. Both attack the CPU problem from different sides without sacrificing security posture.

No community discussion yet for this question.