Which of the following is the MAIN feature of a web application firewall (WAF)?

The correct answer is C. Filtering incoming Hypertext Transfer Protocol (HTTP) traffic. A WAF's core function is to inspect, filter, and block HTTP/HTTPS traffic to and from web applications, protecting against application-layer attacks such as SQL injection, cross-site scripting (XSS), and remote file inclusion. It operates at Layer 7 (application layer) of the…

Submitted by obi.ng· Apr 18, 2026Information Security Program Development and Management

Question

Options

AModifying its predefined configuration automatically based on malicious traffic
BRestricting external traffic within a private network
CFiltering incoming Hypertext Transfer Protocol (HTTP) traffic
DRedirecting distributed denial of service (DDoS) attacks

How the community answered

(34 responses)

A
6% (2)
B
3% (1)
C
91% (31)

Explanation

A WAF's core function is to inspect, filter, and block HTTP/HTTPS traffic to and from web applications, protecting against application-layer attacks such as SQL injection, cross-site scripting (XSS), and remote file inclusion. It operates at Layer 7 (application layer) of the OSI model. Automatically modifying its own configuration (A) describes adaptive or AI-based features, not the main function. Restricting traffic within a private network (B) describes a traditional network firewall. Redirecting DDoS attacks (D) is a feature of dedicated DDoS mitigation services, not the primary purpose of a WAF.

Topics

#Web Application Firewall (WAF)#Application Security#Network Security#HTTP Security

Community Discussion

No community discussion yet for this question.

Full CISM Practice