Which WAF inspection method is the most computationally expensive?

Question

Options

• APositive Security
• BMode Delegation
• CSignature
• DAllow List

• A
  93% (28)
• B
  3% (1)
• D
  3% (1)

Explanation

Positive Security is the most computationally expensive WAF inspection method because it requires building and validating every request against a comprehensive model of all legitimate traffic - every parameter, value, format, and header must be verified. Rather than simply blocking known bad patterns, it must understand the complete "good" behavior profile and reject anything that deviates, demanding deep inspection of every request in full.

Why the distractors are wrong:

• C. Signature (negative security) is less expensive because it only scans for known attack patterns - a targeted lookup, not exhaustive validation of all traffic.
• D. Allow List is lightweight - it typically means permitting specific IPs, URLs, or values via simple matching, with no deep content inspection.
• B. Mode Delegation is not a standard WAF inspection technique; it refers to routing decisions between processing modes, not an inspection method itself.

Memory tip: Think of Positive Security as a strict bouncer with a VIP list of every known-good detail - checking every guest against thousands of specific criteria is exhausting. Signature-based is a bouncer with a mugshot book - only scanning for known criminals, much faster.

No community discussion yet for this question.