Securing Web App Port 443: Best Mitigations
A security team is addressing a risk associated with the attack surface of the organization's web application over port 443. Currently, no advanced network security capabilities are in place. Which of the following would be best to set up? (Choose two.)
Answer
Correct answer: D, E — Deploying a WAF and HIPS provides active prevention and monitoring to secure the web application's attack surface.
Community Votes
63% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core trap is distinguishing between detection (NIDS/SIEM) and prevention/active protection (WAF/HIPS), with WAF being mandatory for Layer 7 traffic.
This question asks for the best advanced network security capabilities to secure a web application on port 443, focusing on mitigating attack surface risks.
Many candidates select NIDS because it monitors the network, but it only detects threats rather than actively preventing exploitation of the web application.
Community Discussion (15 comments)
c7b3ff0
👍 5
Selected: AE
I'm going A and E. F would be a good thing to implement too, but the questions is asking specifically for advanced network capabilities and a SIEM does a lot more than just that. NIDS and WAF are the network-focused options I think it wants us to choose.
9149f41
👍 1
Selected: AE
apologies, The question says for web application, so HIPS is not the answer.
9149f41
👍 2
Selected: DE
Out of all the options, only HIPS and WAF are helpful for prevention. WAF is used for both detection and prevention. The question says Advanced Network Security Capability. To me it is not enough relevant with SIEM or NIDS, as it does not protect the system.
fc040c7
👍 1
Selected: AE
if we are going off of network security. NIDS will monitor the whole network as opposed to just one host (HIPS). and a WAF protect the web application.
ProudFather
👍 3
Selected: E
A Web Application Firewall (WAF) is specifically designed to protect web applications from attacks such as SQL injection, cross-site scripting, and cross-site request forgery. It can filter and block malicious traffic, protecting the web application from vulnerabilities. A Security Information and Event Management (SIEM) system can be used to monitor network traffic and identify potential security threats. By analyzing logs from various sources, including the WAF, the SIEM can detect and respond to attacks in real-time.
c7b3ff0
👍 4
Selected: DE
Changing my previous answer. D&E. WAF protects the web application by filtering and monitoring HTTP/HTTPS traffic (port 443 is HTTPS). A HIPS installed on the web application's server will monitor/analyze activity with the ability to detect and prevent exploitation of vulnerabilities.
Ty13
👍 2
Selected: AE
A. NIDS E. WAF They're asking for setting things up. So set up a WAF and then a NIDS - anomalies would alert admins to take action. SIEM is good because it's still collecting data, but it's more about overall data security whereas NIDS is specifically for the network.
Szajba123
👍 2
Selected: E
Why: E. WAF (Web Application Firewall): A WAF is specifically designed to protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It can help prevent attacks such as SQL injection, cross-site scripting (XSS), and other common web-based threats. Setting up a WAF on port 443 (which is used for HTTPS traffic) would directly address risks associated with web application vulnerabilities. F. SIEM (Security Information and Event Management): A SIEM system collects and analyzes security data from across the network, including logs and events from the web application. It provides real-time analysis, helps in detecting anomalies, and assists in responding to potential threats. This would complement the WAF by providing a broader view of security incidents and facilitating incident response.
ef5549f
👍 1
GPT: A & E
a4e15bd
👍 3
Selected: DE
Changing my previous answer. I got with D & E. Together these two tools should provide a comprehensive defense securing both the application and the underlying server.
suleman1000
👍 1
Selected: AE
NIDS and WAF
cri88
👍 2
Selected: AE
E. WAF (Web Application Firewall) A. NIDS (Network Intrusion Detection System) Explanation: E. WAF (Web Application Firewall): A WAF specifically protects web applications by filtering and monitoring HTTP/HTTPS traffic between a web application and the internet. It can help detect and block attacks targeting the web application, such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities. A. NIDS (Network Intrusion Detection System): NIDS monitors network traffic for suspicious activity and potential threats. Deploying NIDS can help detect malicious activity at the network level, including attempts to exploit vulnerabilities over port 443. These two options would significantly enhance the security of the web application by providing both application-level protection (WAF) and network-level monitoring (NIDS).
nyyankee718
👍 3
Selected: AE
Could be A and F also? NIDS (Network Intrusion Detection System): This system monitors network traffic for potential malicious activity, including attempts to exploit vulnerabilities in the web application. While it primarily detects rather than prevents, it provides valuable insights into potential threats and alerts the security team
mr_reyes
👍 3
Doesn't SIEM only monitor and report, not actually prevent? Wouldn't HIPS be more appropriate?
a4e15bd
👍 3
WAF and SIEM are correct answers.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To effectively secure a web application over port 443 (HTTPS), you must implement controls that inspect and filter application-layer traffic. A Web Application Firewall (WAF) is the primary defense for this purpose, as it inspects HTTP/HTTPS requests for vulnerabilities like SQL injection and XSS. To provide comprehensive protection, a Host-based Intrusion Prevention System (HIPS) should be deployed on the server itself to monitor local activity and prevent exploitation at the OS level. Together, they form a robust 'defense in depth' strategy for the specific application risk.Why the Other Options Are Wrong
Network Intrusion Detection Systems (NIDS) are passive; they alert but do not stop attacks, making them insufficient as a primary 'mitigation' tool compared to active prevention systems. Honeypots are decoys used for intelligence gathering, not for securing production assets. Certificate Revocation Lists (CRLs) manage certificate validity but do not protect against application-layer attacks or intrusion attempts.Community Comment Notes
Community discussion highlights the debate between detection and prevention. One user noted that "SIEM does a lot more than just" network security, suggesting it's too broad. Another commenter emphasized that "WAF protects the web application... HIPS... will monitor/analyze activity," confirming the need for active protection tools. Some users initially chose NIDS, but the consensus shifted toward solutions that prevent exploitation rather than just observe it.Exam Strategy
When asked for 'mitigation techniques' or 'security capabilities' for a specific service, prioritize active prevention tools (Firewalls, WAF, IPS) over passive monitoring tools (NIDS, SIEM). Always consider both the network perimeter and the host layer for critical applications.
Frequently Asked Questions
Why isn't NIDS a correct answer?
NIDS is a detection tool, not a mitigation/prevention tool. It alerts on malicious activity but does not block or stop the attack from succeeding.
Is a WAF enough on its own?
A WAF is essential for Layer 7 protection, but adding HIPS ensures the underlying server is also monitored and protected if the WAF is bypassed.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →