Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

A multinational enterprise runs an API gateway and an Application Load Balancer (ALB) to expose critical financial APIs to both public users and verified third-party payment processors. The ALB is currently protected by an AWS WAF Web ACL containing the AWS Managed Rules Common Rule Set. During a routine security assessment, the team identifies a need to strengthen network security by implementing rate-limiting to mitigate HTTP flood attacks. The new security policy dictates that verified payment processors, who transmit high-volume API requests from a known static block of IP addresses, must never be throttled. However, all incoming traffic—including that from payment processors—must remain protected against common web exploits. Which configuration represents the most secure and operationally efficient way to implement this policy?

  1. Create an AWS WAF IP set containing the payment processors' IP addresses. Configure a custom rate-based rule in the Web ACL, and define a scope-down statement within the rule to evaluate only requests where the source IP is NOT in the IP set. Associate the rate-based rule and the AWS Managed Rules group with the Web ACL, ensuring both are evaluated for all incoming traffic.Answer
  2. B
    Create an AWS WAF IP set containing the payment processors' IP addresses. Configure a custom rule in the Web ACL with an action of ALLOW that matches the IP set, and position it at the highest evaluation priority (lowest numeric value). Below this rule, add the custom rate-based rule and the AWS Managed Rules group.
  3. C
    Create an AWS WAF IP set containing the payment processors' IP addresses. Configure a Service Control Policy (SCP) at the organizational level to bypass Web ACL evaluation for any requests originating from the payment processors' IP set, and apply the rate-based rule globally to the Web ACL.
  4. D
    Create an AWS WAF IP set containing the payment processors' IP addresses. Configure the rate-based rule to encrypt client request payloads using an AWS-managed KMS key, and configure an IAM policy on the ALB that allows the payment processors' IAM roles to bypass the Web ACL inspection.

Answer

Create an AWS WAF IP set containing the payment processors' IP addresses. Configure a custom rate-based rule in the Web ACL, and define a scope-down statement within the rule to evaluate only requests where the source IP is NOT in the IP set. Associate the rate-based rule and the AWS Managed Rules group with the Web ACL, ensuring both are evaluated for all incoming traffic.
The correct solution uses an AWS WAF scope-down statement within the custom rate-based rule to target only requests where the source IP is NOT in the payment processors' IP set. This allows the payment processors' requests to exceed the rate limit threshold without being blocked, while ensuring all traffic (including partner traffic) is still evaluated by the AWS Managed Rules group for exploits.

Step-by-Step Solution

1
Analyze the rate-limiting and vulnerability inspection requirements.
Identify that rate-limiting must exclude payment processors, but all traffic (including payment processors) must be inspected by AWS Managed Rules.
To prevent throttling of legitimate high-volume partners while maintaining full threat protection against web exploits.
2
Evaluate the evaluation behavior of AWS WAF Web ACL rules.
A terminating ALLOW action stops rule evaluation. Placing an ALLOW rule for payment processors at the highest priority would bypass subsequent security rules.
Understanding WAF rule evaluation order prevents introducing security vulnerabilities where trusted sources bypass exploit detection.
3
Implement a scope-down statement on the rate-based rule.
Configuring the rate-based rule to evaluate only requests matching the condition 'NOT in IP set' excludes the payment processors from the rate limit without bypassing other rules in the Web ACL.
This satisfies the requirement to allow high-volume partner traffic while still subjecting it to the common rules and other threat inspections.

Key Concept

Scope-down statements in AWS WAF rate-based rules
Rate this question

Topics

Strengthening Identity, Access, and Network Security