Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

A company hosts a public web application behind an Application Load Balancer (ALB). To protect the application from SQL injection and HTTP flood attacks, the security team associated an AWS WAF WebACL with the ALB. The WebACL contains 33 rules:

1. A rate-based rule to block clients exceeding 20002{}000 requests per 55 minutes.
2. A custom rule to block requests containing SQL injection patterns in the URI.
3. A rule that allows all traffic matching a specific API key header used by partner integrations.

During a simulated attack, security audits show that partner integrations sending requests with the API key header are successfully executing SQL injection attacks, and some partner IPs are overwhelming the application with HTTP floods.

Which configuration change should the Solutions Architect recommend to resolve this security vulnerability?

  1. A
    Apply a Service Control Policy (SCP) at the organizational unit level that denies access to the Application Load Balancer for requests containing SQL injection payloads.
  2. B
    Change the rule action of the partner integration allow rule from Allow to Count, and set the WebACL default action to Block to inspect all traffic.
  3. Reorder the WebACL rules so that the SQL injection block rule and the rate-based block rule are evaluated before the rule that allows traffic matching the API key header.Answer
  4. D
    Configure a custom S3 bucket policy for the WAF log destination that mandates the use of the AWS-managed S3 key (aws/s3) to restrict cross-account access.

Answer

The correct solution is to reorder the WebACL rules so that the SQL injection block rule and the rate-based block rule are evaluated before the rule that allows traffic matching the API key header.
AWS WAF processes rules in a WebACL sequentially from top to bottom. When a request matches a rule with a terminating action like Allow, evaluation immediately stops, and the request is forwarded to the backend. By placing the partner allow rule at the top, malicious requests containing the partner API key header bypassed both the SQL injection and rate-limiting rules. Moving the block rules to the top of the evaluation order ensures that all requests are inspected for threats and rate violations before any allow rule matches.

Step-by-Step Solution

1
Analyze how AWS WAF evaluates rules in a WebACL.
Identify that AWS WAF evaluates rules sequentially, and matching a rule with a terminating action like Allow stops the evaluation of subsequent rules.
This explains why requests matching the partner allow rule bypass the block rules.
2
Assess the current rule execution order.
Confirm that placing the allow rule first permits malicious requests containing the API key header to bypass the SQL injection and rate-limiting rules.
This pinpoints the architectural vulnerability in the current WebACL design.
3
Reorder rules to enforce security policies globally.
Place the block rules for SQL injection and rate limiting above the partner allow rule, ensuring that all traffic is filtered before being allowed.
This secures the ALB endpoints while preserving access for legitimate partner traffic.

Key Concept

AWS WAF rule evaluation order and terminating action behavior
Rate this question

Topics

Strengthening Identity, Access, and Network Security