Securing Web App Port 443: Best Mitigations

SY0-701 By islever Editorial Last updated

Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

DE Deploying a WAF and HIPS provides active prevention and monitoring to secure the web application's attack surface.

Question

A security team is addressing a risk associated with the attack surface of the organization's web application over port 443. Currently, no advanced network security capabilities are in place. Which of the following would be best to set up? (Choose two.)
  1. NIDS
  2. Honeypot
  3. Certificate revocation list
  4. HIPS Correct Answer
  5. WAF Correct Answer

Key Takeaways

The core trap is distinguishing between detection (NIDS/SIEM) and prevention/active protection (WAF/HIPS), with WAF being mandatory for Layer 7 traffic.

This question asks for the best advanced network security capabilities to secure a web application on port 443, focusing on mitigating attack surface risks.

Common mistake: Many candidates select NIDS because it monitors the network, but it only detects threats rather than actively preventing exploitation of the web application.

Expert Analysis

Why the Answer Is Correct

To effectively secure a web application over port 443 (HTTPS), you must implement controls that inspect and filter application-layer traffic. A Web Application Firewall (WAF) is the primary defense for this purpose, as it inspects HTTP/HTTPS requests for vulnerabilities like SQL injection and XSS. To provide comprehensive protection, a Host-based Intrusion Prevention System (HIPS) should be deployed on the server itself to monitor local activity and prevent exploitation at the OS level. Together, they form a robust 'defense in depth' strategy for the specific application risk.

Why the Other Options Are Wrong

Network Intrusion Detection Systems (NIDS) are passive; they alert but do not stop attacks, making them insufficient as a primary 'mitigation' tool compared to active prevention systems. Honeypots are decoys used for intelligence gathering, not for securing production assets. Certificate Revocation Lists (CRLs) manage certificate validity but do not protect against application-layer attacks or intrusion attempts.

Community Comment Notes

Community discussion highlights the debate between detection and prevention. One user noted that "SIEM does a lot more than just" network security, suggesting it's too broad. Another commenter emphasized that "WAF protects the web application... HIPS... will monitor/analyze activity," confirming the need for active protection tools. Some users initially chose NIDS, but the consensus shifted toward solutions that prevent exploitation rather than just observe it.

Exam Strategy

When asked for 'mitigation techniques' or 'security capabilities' for a specific service, prioritize active prevention tools (Firewalls, WAF, IPS) over passive monitoring tools (NIDS, SIEM). Always consider both the network perimeter and the host layer for critical applications.

Frequently Asked Questions

Why isn't NIDS a correct answer?

NIDS is a detection tool, not a mitigation/prevention tool. It alerts on malicious activity but does not block or stop the attack from succeeding.

Is a WAF enough on its own?

A WAF is essential for Layer 7 protection, but adding HIPS ensures the underlying server is also monitored and protected if the WAF is bypassed.

More SY0-701 FAQ →

Community Votes

AE
63%
DE
37%

63% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. c7b3ff0 👍 5
    I'm going A and E. F would be a good thing to implement too, but the questions is asking specifically for advanced network capabilities and a SIEM does a lot more than just that. NIDS and WAF are the network-focused options I think it wants us to choose.
  2. c7b3ff0 👍 4
    Changing my previous answer. D&E. WAF protects the web application by filtering and monitoring HTTP/HTTPS traffic (port 443 is HTTPS). A HIPS installed on the web application's server will monitor/analyze activity with the ability to detect and prevent exploitation of vulnerabilities.
  3. ProudFather 👍 3 Answered E
    A Web Application Firewall (WAF) is specifically designed to protect web applications from attacks such as SQL injection, cross-site scripting, and cross-site request forgery. It can filter and block malicious traffic, protecting the web application from vulnerabilities. A Security Information and Event Management (SIEM) system can be used to monitor network traffic and identify potential security threats. By analyzing logs from various sources, including the WAF, the SIEM can detect and respond to attacks in real-time.
  4. nyyankee718 👍 3
    Could be A and F also? NIDS (Network Intrusion Detection System): This system monitors network traffic for potential malicious activity, including attempts to exploit vulnerabilities in the web application. While it primarily detects rather than prevents, it provides valuable insights into potential threats and alerts the security team
  5. a4e15bd 👍 3
    Changing my previous answer. I got with D & E. Together these two tools should provide a comprehensive defense securing both the application and the underlying server.
Show 10 more comments
  1. mr_reyes 👍 3
    Doesn't SIEM only monitor and report, not actually prevent? Wouldn't HIPS be more appropriate?
  2. a4e15bd 👍 3
    WAF and SIEM are correct answers.
  3. cri88 👍 2
    E. WAF (Web Application Firewall) A. NIDS (Network Intrusion Detection System) Explanation: E. WAF (Web Application Firewall): A WAF specifically protects web applications by filtering and monitoring HTTP/HTTPS traffic between a web application and the internet. It can help detect and block attacks targeting the web application, such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities. A. NIDS (Network Intrusion Detection System): NIDS monitors network traffic for suspicious activity and potential threats. Deploying NIDS can help detect malicious activity at the network level, including attempts to exploit vulnerabilities over port 443. These two options would significantly enhance the security of the web application by providing both application-level protection (WAF) and network-level monitoring (NIDS).
  4. Szajba123 👍 2 Answered E
    Why: E. WAF (Web Application Firewall): A WAF is specifically designed to protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It can help prevent attacks such as SQL injection, cross-site scripting (XSS), and other common web-based threats. Setting up a WAF on port 443 (which is used for HTTPS traffic) would directly address risks associated with web application vulnerabilities. F. SIEM (Security Information and Event Management): A SIEM system collects and analyzes security data from across the network, including logs and events from the web application. It provides real-time analysis, helps in detecting anomalies, and assists in responding to potential threats. This would complement the WAF by providing a broader view of security incidents and facilitating incident response.
  5. Ty13 👍 2
    A. NIDS E. WAF They're asking for setting things up. So set up a WAF and then a NIDS - anomalies would alert admins to take action. SIEM is good because it's still collecting data, but it's more about overall data security whereas NIDS is specifically for the network.
  6. 9149f41 👍 2
    Out of all the options, only HIPS and WAF are helpful for prevention. WAF is used for both detection and prevention. The question says Advanced Network Security Capability. To me it is not enough relevant with SIEM or NIDS, as it does not protect the system.
  7. fc040c7 👍 1
    if we are going off of network security. NIDS will monitor the whole network as opposed to just one host (HIPS). and a WAF protect the web application.
  8. 9149f41 👍 1
    apologies, The question says for web application, so HIPS is not the answer.
  9. suleman1000 👍 1
    NIDS and WAF
  10. ef5549f 👍 1
    GPT: A & E

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide