A WAF primarily inspects which type of traffic to detect web application attacks?

A WAF primarily inspects which type of traffic to detect web application attacks?

• A. HTTP/HTTPS
• B. FTP
• C. SMTP
• D. DNS

Answer: (A)

Web Application Firewalls focus on traffic that targets web applications—the HTTP and HTTPS requests and responses browsers use. They sit at the edge and examine the contents of HTTP requests (methods, URLs, headers, cookies, query parameters, and body) to spot patterns of attacks such as SQL injection, cross-site scripting, and other web exploits. They can block or alter dangerous requests while allowing legitimate traffic. For encrypted HTTPS, the WAF often performs TLS termination so it can inspect the actual payload, or it inspects visible metadata if encryption is preserved. Other protocols like FTP, SMTP, or DNS aren’t primarily used to exploit web applications, so they aren’t the main focus of a WAF.

Web Application Firewalls focus on traffic that targets web applications—the HTTP and HTTPS requests and responses browsers use. They sit at the edge and examine the contents of HTTP requests (methods, URLs, headers, cookies, query parameters, and body) to spot patterns of attacks such as SQL injection, cross-site scripting, and other web exploits. They can block or alter dangerous requests while allowing legitimate traffic. For encrypted HTTPS, the WAF often performs TLS termination so it can inspect the actual payload, or it inspects visible metadata if encryption is preserved. Other protocols like FTP, SMTP, or DNS aren’t primarily used to exploit web applications, so they aren’t the main focus of a WAF.