PT0-002 · Question #356
A penetration tester is performing an assessment against a customer's web application that is hosted in a major cloud provider's environment. The penetration tester observes that the majority of the…
The correct answer is D. Direct-to-origin. If a WAF blocks common web attacks, a direct-to-origin attack is most likely to succeed by bypassing the WAF entirely.
Question
A penetration tester is performing an assessment against a customer's web application that is hosted in a major cloud provider's environment. The penetration tester observes that the majority of the attacks attempted are being blocked by the organization's WAF. Which of the following attacks would be most likely to succeed?
Options
- AReflected XSS
- BBrute-force
- CDDoS
- DDirect-to-origin
How the community answered
(44 responses)- A9% (4)
- B5% (2)
- C2% (1)
- D84% (37)
Why each option
If a WAF blocks common web attacks, a direct-to-origin attack is most likely to succeed by bypassing the WAF entirely.
Reflected XSS is a common web application attack that a WAF is designed to detect and block effectively.
Brute-force attacks against login forms are often protected by WAFs, rate limiting, and other security measures that a WAF can enforce.
DDoS attacks are usually handled by specialized DDoS mitigation services or cloud provider infrastructure, and while a WAF might contribute, it's not the primary defense against large-scale denial of service.
A Direct-to-origin attack involves identifying the true IP address of the web application's origin server (behind the WAF) and then directing attacks straight to that server, completely bypassing the WAF's protections. This is a common technique when a WAF effectively blocks conventional attacks, as it sidesteps the WAF by targeting the server directly.
Concept tested: WAF bypass techniques
Topics
Community Discussion
No community discussion yet for this question.