A WAF without customization will protect the infrastructure from which of the following attack combinations?

DDoS, DNS poisoning, Boink, and Teardrop are network-layer or transport-layer attacks that operate below the web application layer and are outside the scope of a WAF.

Teardrop is an IP fragmentation attack that targets the network/transport layer, not the application layer, so a WAF cannot protect against it regardless of configuration.

SQL Injection and DOM-based XSS are classic OWASP Top 10 web application attacks that WAFs are specifically designed to detect and block via signature-based and behavioral rules out of the box. HTTP exhaustion (a Layer 7 DoS attack) targets the web application layer, which is also within the default protective scope of a WAF.

CSRF and Clickjacking protections typically require custom WAF rules or additional configuration such as anti-CSRF token validation and frame-busting headers, and are not reliably blocked by a default uncustomized WAF.