hardScenarioDesignMidSeniorStaff
Your WAF starts blocking legitimate checkout traffic during a sale. How do you tell an attack from a spike, live?
A WAF false positive during checkout should be debugged rule by rule, not by disabling the whole web application firewall. Compare checkout funnel shape, source spread and per-rule block counters, then move only the offending rule to log-only mode. It also connects false positives to the point an interviewer is testing.
5 min readUpdated 2026-08-15
Answer
Short answer
If a WAF blocks checkout during a sale, inspect per-rule counters and funnel conversion before turning anything off globally. A real sale spike should preserve the funnel shape; a bad WAF rule usually creates a sudden drop at one step, so move that rule to monitor mode and keep the rest active.
Was this answer helpful?
Likely follow-ups
- Your audit log records only that a request was blocked, not which rules scored it. What do you do for the next four hours, and what do you change afterwards?
- The blocked requests turn out to be one payment provider's callback with an unusual body. Where does the fix belong?
- How would you have found this rule before the sale, given you cannot generate real checkout traffic on demand?
- Half the blocked sessions had already completed a purchase earlier that day. What does that tell you, and what does it not?
Related questions
- An upstream feed resets ten thousand of your prices to a penny and orders start arriving. What should have stopped it, and what do you do with the orders that got through?hardAlso on incident-response6 min
- Your fraud score holds up a claim from a customer of eleven years, the investigation finds nothing, and settlement is six weeks late. What did that cost you, and what should the design have done differently?hardAlso on false-positives6 min
- Walk me through applying STRIDE to the boundary where our order service calls the payments service over the network.mediumAlso on appsec4 min
- Your vulnerability scanner just reported four thousand findings across the codebase. How do you actually triage that?mediumAlso on appsec3 min