TechKnowSurge
CompTIA Security+ 3.2
TechKnowSurge Catalog Interactives WAF or Network Firewall?
InteractiveSecurityFree

WAF or Network Firewall?

Decide which control has to stop each threat to a DMZ web shop. Land five in a row.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

Web applications are attacked more than most applications, and they have to be reachable. A common design puts the web servers in a DMZ, or screened subnet, with the firewall opening a hole so people can get to them, while the internal network behind it stays protected differently. The standard network firewall is good at what it decides on: addresses and ports. Traffic to a port that is not open, to the internal network, or from a blocked range never gets in. But once the web port is open, it lets web requests through without judging what is inside them. A web application firewall (WAF) sits in front of the web servers and does judge them. It looks for certain kinds of behaviour and traffic aimed at the application, such as a denial-of-service attempt, and attack content carried inside ordinary requests, and stops it before it reaches the app. To decide a card, ask whether the threat comes in through the allowed web port.

What you'll learn

Aligned to

CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

Key terms

Web Application Firewall
WAF
A firewall that filters and monitors HTTP traffic to and from a web application to prevent attacks.
Firewall
A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Demilitarized Zone
DMZ
A network segment that sits between a trusted internal network and an untrusted external network, hosting public-facing services.
Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.

Topics

Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →