SkillTestPro | CCNP Security 300-740 SSCA Practice Test 14

CCNP Security 300-740 SSCA Practice Test 14 (Hard) - Web Application Firewalls and DDoS Protection

CISCO CCNP Security Exam Logo

1 / 10

Which security control inspects HTTP/HTTPS traffic destined for a web application and blocks requests matching known attack patterns such as SQL injection or cross-site scripting?

ARP cache, which maps IP to MAC addresses rather than inspecting application-layer web traffic

DHCP relay, which forwards address assignment requests rather than inspecting application-layer web traffic

NTP server, which synchronizes clocks rather than inspecting application-layer web traffic

SNMP trap receiver, which collects device alerts rather than inspecting application-layer web traffic

A Web Application Firewall (WAF)

DNS caching resolver, which caches name resolution responses rather than inspecting application-layer web traffic

2 / 10

Which type of attack is specifically designed to overwhelm a web application or network resource with excessive traffic or requests, aiming to make the service unavailable to legitimate users?

A privilege escalation attack, which targets gaining higher access rights rather than overwhelming resource availability

A phishing attack, which targets human deception rather than overwhelming resource availability

A Distributed Denial of Service (DDoS) attack

A man-in-the-middle attack, which targets communication interception rather than overwhelming resource availability

A cross-site scripting attack, which targets client-side script execution rather than overwhelming resource availability

A SQL injection attack, which targets database query logic rather than overwhelming resource availability

3 / 10

Which WAF rule design practice would help protect a web application against SQL injection attempts while minimizing the risk of blocking legitimate user input?

Combining signature-based detection of known SQL injection patterns with context-aware input validation specific to each form field's expected data type

Blocking all traffic from any browser regardless of the request's actual content

Disabling the WAF entirely to eliminate the possibility of blocking legitimate input

Applying identical, non-specific validation rules to every field regardless of its expected data type, based on standard platform behavior, which is inconsistent with expected behavior

Blocking every request containing the letter 'S' anywhere in the URL or form data

Allowing all input to pass through unfiltered to maximize application compatibility

4 / 10

Which DDoS mitigation approach helps absorb and filter a volumetric attack before it reaches an organization's origin servers?

Disabling all firewall rules at the origin to allow traffic to pass through more quickly

Physically unplugging the origin server's network cable during business hours

Printing a notice on the website informing users that the service may be temporarily unavailable

Relying exclusively on the origin server's local operating system firewall with no upstream scrubbing capacity, under normal operating conditions, regardless of the platform version in use

Routing traffic through a cloud-based scrubbing service or CDN with sufficient capacity to absorb and filter malicious traffic upstream of the origin

Increasing the origin server's CPU clock speed with no upstream filtering or capacity planning involved

5 / 10

Which characteristic distinguishes a volumetric DDoS attack from an application-layer (Layer 7) DDoS attack?

A volumetric attack and an application-layer attack are simply two different names for the exact same identical attack technique

A volumetric attack aims to exhaust network bandwidth or infrastructure capacity with sheer traffic volume, while an application-layer attack targets specific application resources with seemingly legitimate but resource-intensive requests

A volumetric attack can only target email servers while an application-layer attack can only target web servers

An application-layer attack always requires more total bandwidth than any volumetric attack, reversing their typical characteristics, which is not the standard approach, in most deployment scenarios, in a properly maintained environment, based on standard platform behavior

Volumetric attacks exclusively target DNS servers with no relevance to any other type of network resource

Application-layer attacks are always easier to detect than volumetric attacks due to their obviously excessive bandwidth

6 / 10

Which WAF and DDoS protection combination would provide comprehensive coverage for a public-facing e-commerce web application?

DDoS scrubbing capacity that is deliberately undersized relative to the application's expected legitimate traffic volume, based on standard platform behavior, in accordance with common design practices, in most deployment scenarios

A WAF alone with no DDoS protection capacity of any kind, leaving the origin vulnerable to volumetric flooding

DDoS scrubbing alone with no WAF, leaving the application vulnerable to SQL injection and cross-site scripting

A WAF inspecting and filtering application-layer requests for attack patterns, combined with upstream DDoS scrubbing capacity to absorb volumetric and application-layer flood attempts before they reach the origin

Neither a WAF nor DDoS protection, relying exclusively on the origin server's default operating system firewall

A WAF configured to allow all traffic through unfiltered to maximize application compatibility with legitimate users

7 / 10

Which risk would most likely result from an organization deploying a WAF with default, out-of-the-box rules and never tuning them to the specific application's behavior?

The WAF could generate excessive false positives blocking legitimate traffic, or miss application-specific attack patterns not covered by generic default rules

The WAF would automatically disable itself if default rules are never customized

The WAF would automatically shut down the entire application the first time it is deployed

All other unrelated applications in the organization would automatically inherit the same WAF configuration

The organization's DNS infrastructure would automatically fail as a direct result of using default WAF rules

The WAF would automatically achieve perfect detection accuracy for every possible attack technique with no tuning required, under normal operating conditions, which is inconsistent with expected behavior

8 / 10

Which factor would most influence how much DDoS scrubbing capacity an organization provisions for a given public-facing application?

The average outdoor temperature near the application team's office location

The color scheme configured for the application's user interface

The number of parking spaces reserved for the application team's staff

The application's business criticality, its historical or anticipated attack exposure, and the potential financial or reputational impact of an outage

The specific brand of coffee served in the application team's office

The font used in the application team's internal newsletter

9 / 10

Which practice would help an organization validate that its WAF and DDoS protection configuration actually performs as expected before relying on it during a real attack?

Disabling the WAF and DDoS protection during testing to avoid any impact on the testing process

Waiting for an actual, unplanned attack to be the first real test of the configuration's effectiveness

Testing the configuration exclusively by reading its settings screen with no actual traffic simulation involved

Conducting regular, controlled testing (such as simulated attack traffic or third-party penetration testing) against the WAF and DDoS mitigation configuration in a safe, authorized manner

Relying exclusively on the vendor's marketing claims about the product's effectiveness with no independent testing, in most deployment scenarios, which is inconsistent with expected behavior

Assuming the configuration works correctly simply because it was deployed, with no testing of any kind

10 / 10

Which statement accurately describes why WAF and DDoS protection are considered complementary rather than interchangeable controls?

DDoS protection alone is always sufficient to fully prevent any SQL injection or cross-site scripting attack

DDoS protection inspects application-layer content for attack patterns while a WAF absorbs volumetric traffic floods, reversing their actual roles, regardless of the platform version in use, under typical configuration conditions, in a properly maintained environment

A WAF alone is always sufficient to fully mitigate any DDoS attack regardless of its scale or type

A WAF and DDoS protection are simply two different names for the exact same identical control with no distinction

An organization must choose exactly one of a WAF or DDoS protection and can never deploy both together

A WAF focuses on inspecting and filtering application-layer content for known attack patterns, while DDoS protection focuses on absorbing and mitigating traffic volume or request-rate floods aimed at exhausting resource availability

Your score is

The average score is 0%