Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA Security+ · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Why D is the Best Choice The Core Vulnerability: A public e-commerce website that accepts file uploads is highly vulnerable to web-application attacks. Attackers frequently use file upload fields to upload malicious scripts or payload-carrying files designed to exploit the underlying web server or database (such as Command Injection, Path Traversal, or Remote Code Execution). The Role of a WAF: A Web Application Firewall (WAF) operates at Layer 7 (Application Layer) of the OSI model. It specifically inspects HTTP/HTTPS traffic to and from web applications. It can analyze the input fields, HTTP POST requests, and upload behaviors to identify and block application-specific attacks like command injection, SQL injection, and Cross-Site Scripting (XSS).
A UTM (Unified Threat Management) device can scan incoming files for malware before they are processed by the server.
A Web Application Firewall (WAF) protects web applications by filtering and blocking malicious HTTP traffic. It’s designed to prevent application-layer attacks, such as command injections, SQL injections, or cross-site scripting (XSS), which could exploit vulnerabilities in the upload process or web application. Since PDF uploads could be used to attempt command injections (e.g., by manipulating file metadata or exploiting upload handling), a WAF is highly relevant. It actively blocks malicious requests, making it a proactive and targeted solution for a public e-commerce site.