Prevention against which type of attack is configurable in Web-Application and API Security (WAAS)?

Question

Options

• Acredential stuffing
• Bcross-site scripting (XSS)
• Cshoulder surfing
• Ddistributed denial of service (DDoS)

• A
  5% (1)
• B
  89% (17)
• C
  5% (1)

Explanation

Cross-site scripting (XSS) is correct because WAAS is a Web Application Firewall (WAF) solution designed to inspect and filter HTTP/HTTPS traffic at the application layer - XSS attacks, where malicious scripts are injected into trusted web pages, are a textbook WAF use case that WAAS explicitly covers alongside SQL injection, command injection, and similar OWASP Top 10 threats.

Credential stuffing (A) is primarily an authentication/bot-mitigation concern addressed by rate limiting, MFA, and dedicated bot protection - not a WAF rule set.

Shoulder surfing (C) is a physical security attack (someone literally looking over your shoulder); no software security layer can prevent it.

DDoS (D) operates at the network/transport layer and requires dedicated volumetric attack mitigation (e.g., scrubbing centers), which is architecturally separate from a WAF - WAAS protects application logic, not infrastructure availability.

Memory tip: Think of WAAS as a code-level bodyguard - it only stops attacks that live inside HTTP requests and web code. XSS lives there; shoulder surfing and DDoS don't, and credential stuffing requires a different kind of guard (identity-aware, not content-aware).

No community discussion yet for this question.