A penetration tester is performing an assessment against a customer's web application that is hosted in a major cloud provider's environment. The penetration tester observes that the majority of the…

The correct answer is D. Direct-to-origin. When a web application firewall (WAF) is blocking most of the attacks, a direct-to-origin attack is likely to succeed. A direct-to-origin attack targets the backend servers directly, bypassing the WAF. This type of attack exploits any functionality that allows direct access to…

Submitted by stefanr· Mar 6, 2026Attacks and Exploits

Question

A penetration tester is performing an assessment against a customer's web application that is hosted in a major cloud provider's environment. The penetration tester observes that the majority of the attacks attempted are being blocked by the organization's WAF. Which of the following attacks would be most likely to succeed?

Options

AReflected XSS
BBrute-force
CDDoS
DDirect-to-origin

How the community answered

(34 responses)

A
18% (6)
B
6% (2)
C
6% (2)
D
71% (24)

Explanation

When a web application firewall (WAF) is blocking most of the attacks, a direct-to-origin attack is likely to succeed. A direct-to-origin attack targets the backend servers directly, bypassing the WAF. This type of attack exploits any functionality that allows direct access to the origin servers (backend servers) without passing through the WAF. Techniques such as manipulating DNS, exploiting misconfigurations, or using direct IP access can be employed to bypass the WAF, making direct-to- origin attacks effective under these circumstances.

Topics

#WAF bypass#direct-to-origin attack#web application attacks#cloud security

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice