Exam 312-49v10 topic 1 question 719 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 719
Topic #: 1

A major corporation has faced multiple SQL injection attacks on its web application. They have a ModSecurity WAF in place with default settings. However, attacks are still getting through. The forensic investigator recommends a measure to enhance security. What is the most likely recommendation?

A. Customize ModSecurity rules according to their environment
B. Replace ModSecurity with a next-generation firewall (NGFW)
C. Install an additional conventional firewall for protection
D. Implement real-time alerting and extensive logging capabilities

Show Suggested Answer

Suggested Answer: A 🗳️

by Elb at May 28, 2024, 1:09 p.m.

Comments

Submit Cancel

044f354

3 months, 3 weeks ago

Selected Answer: A

Answer: A Explanation: Default rules often lack environment-specific tuning (A) ✅ Tailored rules address app-specific vulnerabilities bypassing generic filters (B) ❌ ModSecurity already provides WAF capabilities; replacement isn't optimal (C) ❌ Conventional firewalls don't inspect SQLi in HTTP payloads (D) ❌ Logging improves visibility but doesn't prevent active attacks ----- If you agree, please UPVOTE. Each time you upvote someone with a yellow "SELECTED ANSWER: " banner (like me) your vote is added to the Community Vote Distribution, which helps the community by crowdsourcing correct answers.

upvoted 1 times

...

jingu_bingo

7 months ago

Selected Answer: A

keyword: "default settings", which may not suit their environment thus allowing attacks to penetrate in and out without resistance.

upvoted 2 times

...

Elb

7 months, 1 week ago

The modsecurity.conf file includes the default configurations of ModSecurity. This tool also allows administrators to write customized rules based on their environment.

upvoted 1 times

...