Which vulnerabilities can be mitigated by proper security configuration and a Web Application Firewall?

• A. Cross-Site Scripting
• B. Injection and Security Misconfiguration
• C. Broken Authentication
• D. Insecure Direct Object References

Answer: (B)

Mitigating injection flaws and misconfigurations is what a Web Application Firewall combined with proper security configuration targets. A WAF sits in front of the application and can block many injection attempts—like SQL injection or command injection—by filtering out malicious payloads the app might otherwise execute. At the same time, tightening security configuration reduces exposed weaknesses such as default credentials, verbose error messages, unnecessary services, and weak headers, closing off common misconfigurations that attackers could exploit.

Cross-Site Scripting is typically addressed mainly through proper output encoding and content security policies, with a WAF providing only supplementary protection that isn’t always reliable in the long term. Broken authentication and insecure direct object references involve authentication/authorization flaws and access-control design, which require solid implementation and secure coding practices rather than configuration and WAF rules alone.