A WAF without customization will protect the infrastructure from which of the following attack combinations?

Boink and Teardrop are IP fragmentation attacks that operate at the network/transport layer (Layer 3/4), which a WAF operating at Layer 7 cannot inspect or block; DNS poisoning also occurs outside the HTTP application layer.

Teardrop is a network-layer fragmentation attack that a WAF cannot mitigate, making this combination incorrect even if the other two items might be partially addressed.

SQL Injection and XSS (including DOM-based variants) are OWASP Top 10 web application attacks that WAFs are specifically built to detect using signature-based and heuristic rules out of the box. HTTP exhaustion attacks (slow HTTP, HTTP flood) target the web server at the application layer and are also within the default ruleset of most commercial WAFs.

CSRF and Clickjacking protection typically require custom WAF rules or application-level tokens (e.g., SameSite cookies, X-Frame-Options headers) and are not reliably blocked by a default WAF configuration.