SY0-301 · Question #542
A security engineer is reviewing log data and sees the output below: POST: /payload.php HTTP/1.1 HOST: localhost Accept: / ******* HTTP/1.1 403 Forbidden Connection: close Log: Access denied with…
The correct answer is B. Web application firewall. The log entry shows an HTTP POST request being blocked with a 403 response and a 'form bypass' pattern match, which is characteristic of a Web Application Firewall inspecting and blocking malicious HTTP payloads.
Question
A security engineer is reviewing log data and sees the output below:
POST: /payload.php HTTP/1.1 HOST: localhost Accept: / ******* HTTP/1.1 403 Forbidden Connection: close Log: Access denied with 403. Pattern matches form bypass Which of the following technologies was MOST likely being used to generate this log?
Options
- AHost-based Intrusion Detection System
- BWeb application firewall
- CNetwork-based Intrusion Detection System
- DStateful Inspection Firewall
- EURL Content Filter
How the community answered
(40 responses)- A8% (3)
- B85% (34)
- C3% (1)
- E5% (2)
Why each option
The log entry shows an HTTP POST request being blocked with a 403 response and a 'form bypass' pattern match, which is characteristic of a Web Application Firewall inspecting and blocking malicious HTTP payloads.
A Host-based IDS monitors activity on a specific host and does not generate HTTP 403 block responses in this manner.
A Web Application Firewall (WAF) operates at the application layer and inspects HTTP/HTTPS traffic for attack patterns such as form bypass attempts, SQLi, or XSS. When a match is found, the WAF issues a 403 Forbidden response and logs the pattern match, which is exactly what the output describes.
A Network-based IDS detects and alerts on traffic patterns but does not block requests or return HTTP 403 responses.
A Stateful Inspection Firewall tracks connection state at Layer 3/4 but does not perform application-layer pattern matching on HTTP payloads.
A URL Content Filter inspects URLs for policy violations but does not match form bypass payload patterns within HTTP POST bodies.
Concept tested: Web Application Firewall pattern matching and blocking
Source: https://owasp.org/www-community/Web_Application_Firewall
Topics
Community Discussion
No community discussion yet for this question.