IMPERVA-WAF Practice Test

IMPERVA-WAF practice test: what's covered

• Imperva WAF Gateway + Cloud WAF
• Policies
• Signatures
• Dynamic Profiling

Free IMPERVA-WAF sample questions

1. In an Imperva WAF Gateway (on-prem/SecureSphere) deployment, the "MX" (Management Server) is responsible for:

   • A. Inspecting traffic inline
   • B. Central management — policy configuration, aggregating events/alerts from Gateways, reporting, and administration; the Gateways do the actual traffic inspection
   • C. BGP routing
   • D. Storing backups only
   Show answer

   Correct: B. The MX is the brain (management, policy, events, reporting); Gateways are the inline inspection engines. One MX manages many Gateways. Understand this split — it mirrors many enterprise security architectures.

2. A WAF Gateway can be deployed in which inline mode to actively block?

   • A. Only passive monitoring
   • B. Inline bridge / reverse-proxy / transparent modes — where it sits in the traffic path and can block; (a non-inline sniffing/monitor mode can only alert, not block)
   • C. BGP-only mode
   • D. DNS-only mode
   Show answer

   Correct: B. To BLOCK, the Gateway must be inline (bridge/transparent/reverse-proxy). A passive sniffing (monitor/SPAN) deployment can only detect/alert — it can't drop traffic. Mode choice determines enforcement capability.

3. Which TWO Imperva WAF deployment models exist? (Choose 2)

   • A. On-prem WAF Gateway (SecureSphere) — appliances/VMs you operate
   • B. Cloud WAF (formerly Incapsula) — SaaS, traffic routed via DNS to Imperva's network
   • C. A BGP route reflector
   • D. A fax gateway
   Show answer

   Correct: A and B. Imperva WAF comes as on-prem Gateway (SecureSphere, MX+Gateways) and Cloud WAF (SaaS, DNS-routed, ex-Incapsula). Many run hybrid. BGP/fax are unrelated.

4. Imperva Cloud WAF protects an application by:

   • A. Installing an agent on each user device
   • B. Routing the site's traffic through Imperva's cloud (via DNS change to Imperva) so inspection/mitigation happens before requests reach origin — origin then locked to accept only Imperva
   • C. Advertising the origin via BGP
   • D. Doing nothing
   Show answer

   Correct: B. Cloud WAF works like other cloud WAFs: change DNS so traffic flows through Imperva's network, where WAF/DDoS/bot policy runs, then to origin. Restrict origin to Imperva IPs so attackers can't bypass.

5. In a Gateway deployment, where are security policies authored and pushed from?

   • A. On each Gateway individually
   • B. The MX management server — policies are configured centrally and applied to the Gateways, with events flowing back to the MX
   • C. BGP
   • D. A spreadsheet
   Show answer

   Correct: B. Central management via MX: author policy once, apply to Gateways, collect events back. This single-pane model scales and keeps policy consistent across many Gateways. Per-Gateway editing would cause drift.

Last updated: 2026-10-19

IMPERVA-WAF practice test FAQ