A retailer protects its customer-facing web application solely with a web application firewall (WAF). During a penetration test, the tester slips an encoded injection payload past the WAF and reaches the backend database directly. Which approach would BEST limit the damage from a future WAF bypass?
Select an answer to reveal the explanation.
Short Explanation
Think of a castle with one great wall and nothing behind it. Once someone's over that wall, they own the place. Defense in depth gives you more walls that don't share the same weakness, so the trap here is believing a bigger or doubled WAF fixes things when it fails the exact same way.
Full Explanation
Defense in depth places several independent controls in the path of an attack so that the failure of one does not expose the asset. When a WAF is the only safeguard, any evasion technique that defeats its signatures leads straight to the data. Server-side input validation stops malformed input in the application itself, a least-privilege database account limits what an injected query can read or change, and database activity monitoring detects abnormal queries even when they succeed. Each layer relies on a different mechanism, so one encoding trick cannot defeat all of them. Upgrading to a faster WAF with more signatures leaves the design with a single point of failure; the same class of evasion will eventually work again. Chaining a second WAF from the same vendor adds an identical layer with identical blind spots, which is redundancy rather than depth. Relocating the WAF ahead of the load balancer changes where inspection happens but not how much protection exists behind it. Exam caveat: defense in depth is judged by diversity and independence of controls, not by stacking more of the same control. Operational check: map every path from the internet to the database and confirm that at least two controls of different types (preventive and detective, network and application) must fail before data can be read or changed.