CV0-004 · Question #220
A cross-site request forgery vulnerability exploited a web application that was hosted in a public laaS network. A security engineer determined that deploying a WAF in blocking mode at a CDN would…
The correct answer is C. Add an ACL to the VM subnet. The WAF at the CDN is being bypassed because attackers are sending requests directly to the application VMs' IP addresses, circumventing the CDN entirely. Adding an ACL (Access Control List) to the VM subnet (Option C) restricts inbound traffic so that only the CDN's IP ranges…
Question
A cross-site request forgery vulnerability exploited a web application that was hosted in a public laaS network. A security engineer determined that deploying a WAF in blocking mode at a CDN would prevent the application from being exploited again. However, a week after implementing the WAF, the application was exploited again. Which of the following should the security engineer do to make the WAF control effective?
Options
- AConfigure the DDoS protection on the CDN.
- BInstall endpoint protection software on the VMs
- CAdd an ACL to the VM subnet.
- DDeploy an IDS on the laaS network.
How the community answered
(46 responses)- A17% (8)
- B9% (4)
- C70% (32)
- D4% (2)
Explanation
The WAF at the CDN is being bypassed because attackers are sending requests directly to the application VMs' IP addresses, circumventing the CDN entirely. Adding an ACL (Access Control List) to the VM subnet (Option C) restricts inbound traffic so that only the CDN's IP ranges are permitted to reach the VMs - forcing all traffic through the WAF and making it effective. Option A (DDoS protection on the CDN) does not address CSRF attacks and does not prevent direct-to-VM traffic. Option B (endpoint protection on VMs) is host-based security and does not enforce network-layer traffic routing through the WAF. Option D (IDS on the IaaS network) only detects attacks and generates alerts; it does not block traffic and would not prevent re-exploitation.
Topics
Community Discussion
No community discussion yet for this question.