thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Foundational

Web Application Firewall (WAF)

Layer 7 firewall that inspects HTTP/HTTPS traffic to protect web applications from attacks such as SQL injection and XSS.

Definition

WAFs use signatures, rule sets such as the OWASP Core Rule Set, anomaly scoring, and behavioral analysis to block malicious requests. They are deployed as reverse proxies, cloud services, or modules (AWS WAF, Azure Web Application Firewall, Cloudflare, F5). WAFs complement but do not replace secure coding.

Example

An AWS WAF managed rule blocks a request containing ' OR 1=1-- in a query parameter.

Exam tip

Choose WAF to protect a web app from injection and XSS; a network firewall can't inspect those payloads.

Related terms