Which Solution Protects a Web Server from SQL Injection?

Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilities Describe security vulnerabilities and exploits such as software bugs, weak and/or hardcoded passwords, OWASP top ten, missing encryption ciphers, buffer overflow, path traversal, cross-site scripting/forgery, SQL injection, and identification and prioritization using CVEs and CVSS scores

Which solution should a network administrator deploy to protect a webserver from SQL injection attacks?

  1. IDS
  2. Secure Web Appliance
  3. ISE
  4. IPS Correct Answer
Answer Correct answer: D — Deploy an inline IPS with SQL injection signatures to inspect and block malicious requests to the web server.

Community Insight

The question tests whether you can map SQL injection defense to an inline IPS signature capability, not to a web proxy or identity service; the trap is treating Secure Web Appliance as a WAF.

SQL injection is an application-layer attack that an inline intrusion prevention system can block by inspecting traffic for malicious SQL patterns. This page explains why IPS (D) is the best fit among the listed Cisco security solutions, while distinguishing it from IDS, a web proxy, and ISE.

Learners often pick Secure Web Appliance because it sounds like a web security product, but it is a secure web proxy for user internet access, not an inline WAF or IPS for protecting a server from SQL injection traffic.

Community Discussion (6 comments)

XBfoundX 👍 1 Selected: D
Intrusion Prevention System Signatures In certain situations, it may be possible to detect and prevent SQL injection attacks using an intrusion prevention system (IPS). For an IPS to be effective, it must have visibility into the traffic of the application. For applications that use end-to-end encryption with HTTPS (for example, applications that use HTTPS without termination or acceleration at an intermediate network device), an IPS cannot identify traffic with characteristics of a SQL injection attack. The Cisco Intrusion Prevention System solution currently contains the following signatures that may indicate the presence of a SQL injection attack. This information is updated as of the S702 Cisco IPS signature update release.
942f31a 👍 1 Selected: B
To protect a webserver from SQL injection attacks, deploy a Web Application Firewall (WAF) such as the Cisco Secure Web Application Firewall (WAF) solution.
XBfoundX 👍 1
WSA is NOT AT ALL a WAF solution, is a web proxy! Cisco WAF solution is Cisco WAAP. A proxy is not a WAF, that service is totally different. A WAF inspect the HTTPS header and check all the signatures to understand if in that payload there is something that may be related to some code injection or cross-site scripting injection. Somtimes and IPs may detect based on some signatures, but that is not the main IPS job.
TanHK 👍 1 Selected: B
Frankly speaking, make no sense with IPS, I feel that there is typo to indicate Secure Web Application, and that will be the only answer lead to option B
luismg 👍 1 Selected: D
if it is an incoming attack an IPS will stop it.
Premium_Pils 👍 2 Selected: D
https://sec.cloudapps.cisco.com/security/center/resources/sql_injection.html Section: Defenses in the Network

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

An IPS is deployed inline and can inspect application traffic for SQL injection signatures and drop matching requests before they reach the web server. Cisco's own SQL injection guidance places intrusion prevention among the network defenses that can detect and prevent these attacks when the IPS has visibility into the application traffic. Among the four options, IPS is the only one that combines inline enforcement with attack-signature inspection for server-bound HTTP requests. This is why the best answer is D, even though a dedicated WAF would be the more precise control when available.

Why the Other Options Are Wrong

IDS (A) is passive: it detects and alerts on suspected SQL injection but does not sit inline to block the request. Secure Web Appliance (B) is a secure web proxy that controls user web access and malware/URL risk; it is not the same as a WAF and is not positioned to protect an inbound web server from SQL injection. ISE (C) is an identity and network access control platform using 802.1X, MAB, and profiling, not an HTTP application-layer inspection engine. A dedicated WAF or WAAP would be ideal, but it is not among the listed choices.

Community Comment Notes

Community learners split between IPS and Secure Web Appliance, with the IPS camp pointing to Cisco's SQL injection defense article. XBfoundX quoted that IPS signatures can "detect and prevent SQL injection attacks using an intrusion prevention system (IPS)" when the IPS has traffic visibility. Another commenter stressed that "WSA is NOT AT ALL a WAF solution, is a web proxy!" which is the key distinction behind rejecting option B. TanHK suspected a typo in option B and wanted "Secure Web Application," but the option as written is Secure Web Appliance, so the proxy reading stands and D remains the defensible Cisco exam answer.

Official Reference

https://sec.cloudapps.cisco.com/security/center/resources/sql_injection.html

Exam Strategy

When a question asks how to protect a server from an application-layer exploit, distinguish inline prevention from detection and from user-focused proxies. If a WAF is not offered, the inline IPS that can inspect and drop malicious requests is the intended Cisco answer; IDS only alerts, and ISE handles access control.

Frequently Asked Questions

Why is Secure Web Appliance not the correct SQL injection defense here?

It is a secure web proxy for user internet access, not a WAF or inline IPS for protecting a server; it lacks the application attack inspection intended in this scenario.

Does an IPS still work if the web server uses HTTPS?

Only if the IPS can see decrypted traffic, such as behind TLS termination; otherwise encrypted SQL injection payloads cannot be inspected.

More 350-701 FAQ →

Related Analysis

Which two global commands must the network administrator imp

A-Grade

What is offered by an EPP solution but not an EDR solution?

A-Grade

Which feature does the IaaS model provide?

S-Grade

← Back to 350-701 Study Guide