712-50 Question 324
Single answerIdentify web application vulnerabilities and attacks and web application security tools to counter attacksA global retailer is preparing for a major e-commerce launch after several security findings in pre-production. The application uses a modern web framework, multiple third-party JavaScript libraries, and a REST API consumed by a single-page front end. Recent testing found reflected cross-site scripting in a search parameter, insecure direct object references in an order-history API, and inconsistent input validation across microservices. The CISO has approved funding for only one initial control strategy this quarter and wants the option that will most effectively reduce immediate business risk while also improving visibility into active attacks. Which approach should the security leader prioritize first?
- A
Deploy and tune a web application firewall (WAF) in front of the application while initiating remediation of the identified code flaws
- B
Rely on network perimeter firewalls because the vulnerabilities are already known and can be blocked at the IP and port level
- C
Conduct annual vulnerability scanning only, since the issues were identified before production and developers can address them later
- D
Replace TLS certificates and enforce stronger cipher suites to prevent exploitation of the reported web application issues
Show answer and explanation
Correct answer: A
Explanation
The best answer is to deploy and tune a WAF as an initial control strategy while remediation proceeds. From a CCISO perspective, the question emphasizes risk prioritization, compensating controls, and operational visibility rather than purely technical perfection. The identified issues include both injection-style/browser-executed attack vectors and authorization flaws. A WAF is not a substitute for secure coding, especially for broken access control issues such as insecure direct object references, which typically require code and authorization design fixes. However, it can reduce exposure to many common web attacks, help enforce request filtering, rate limiting, virtual patching, and provide logging and alerting during a high-risk launch window.
This aligns with OWASP guidance: the OWASP Top 10 highlights Cross-Site Scripting and Broken Access Control as significant risks, and the OWASP Web Security Testing Guide and ASVS stress that runtime controls should complement, not replace, secure design and remediation. NIST guidance on application security and continuous monitoring similarly supports layered controls and risk-based mitigation. For executive decision-making, the most defensible immediate action is a compensating control that reduces exploitability and improves detection while engineering addresses the underlying flaws.
- A. Correct.
Correct. A properly deployed and tuned WAF can provide immediate compensating controls against common web attacks such as reflected XSS and some abusive request patterns, while also generating operational visibility through logs, alerts, and attack telemetry. Although a WAF does not fix insecure direct object references or poor authorization logic in code, it can reduce exposure during remediation and is aligned with a risk-based, defense-in-depth approach. For a CISO-level decision, this option best balances short-term risk reduction with improved monitoring.
- B. Incorrect.
Incorrect. Traditional network firewalls operate primarily on network and transport layer attributes such as IP addresses, ports, and protocols. They are not designed to understand application-layer payloads well enough to reliably detect and mitigate issues like reflected XSS, parameter tampering, or broken access control in a REST API. This option reflects a common misconception that perimeter controls alone are sufficient for web application threats.
- C. Incorrect.
Incorrect. Annual vulnerability scanning is inadequate for an internet-facing e-commerce platform with known pre-production findings and imminent launch. Scanning may help identify some weaknesses, but it does not provide immediate runtime protection or meaningful attack visibility during the launch period. Delaying remediation because issues were found before production ignores the business impact of exploitation and does not reflect modern secure development or continuous assurance practices.
- D. Incorrect.
Incorrect. Strong TLS configuration is important for protecting data in transit, but it does not address the root causes of reflected XSS, insecure direct object references, or inconsistent server-side validation. Attackers can still exploit application logic flaws over an encrypted channel. This option is plausible because transport security is often prioritized, but it is not the most effective control for the specific web application risks described.