Examkin

Question

Difficulty: EasyStrengthening Identity, Access, and Network Security

A company is reviewing the AWS WAF configuration for an existing web application hosted behind an Application Load Balancer. The security team has configured an AWS WAF Web ACL with two rules: a rule with priority 10 that allows all traffic from a partner's IP address range, and a rule with priority 20 that blocks requests containing SQL injection patterns. Developers report that malicious SQL injection attacks originating from the partner's IP address range are successfully reaching the application. Which adjustment should a solutions architect recommend to resolve this security issue?

  1. Reorder the Web ACL rules so that the SQL injection block rule has a higher priority (lower priority number) than the partner IP address allow rule.Answer
  2. B
    Apply a Service Control Policy (SCP) to the AWS Organizations member account that denies SQL injection attempts, as SCPs override local WAF rule evaluation orders.
  3. C
    Configure the WAF Web ACL logs to be encrypted with an AWS-managed KMS key (aws/s3) and delegate decryption access directly to the partner's IAM role.
  4. D
    Associate the Application Load Balancer's public VPC with a Route 53 Private Hosted Zone containing resolver rules that drop the SQL injection requests.

Answer

Reorder the Web ACL rules so that the SQL injection block rule has a higher priority (lower priority number) than the partner IP address allow rule.
AWS WAF evaluates rules in a Web ACL sequentially starting from the lowest priority number. Because the allow rule for the partner's IP has a priority of 10 and the SQL injection block rule has a priority of 20, any request from that IP matches the allow rule first and stops evaluation. Reordering the rules so that the SQL injection block rule has a higher priority (lower priority number) ensures that malicious SQL injection payloads from any source are inspected and blocked before the IP allow rule is processed.

Step-by-Step Solution

1
Analyze how AWS WAF processes Web ACL rules.
AWS WAF processes rules sequentially based on their priority values, starting from the lowest numerical value.
Understanding the sequential evaluation model is necessary to diagnose why the block rule is bypassed.
2
Determine the cause of the rule bypass.
Requests from the partner's IP match the allow rule at priority 10 first, terminating further evaluation and skipping the block rule at priority 20.
Allow actions in AWS WAF are terminating actions, meaning matching requests stop further Web ACL processing.
3
Adjust the rule evaluation sequence.
Moving the SQL injection block rule to a lower numerical priority (e.g., priority 5) ensures it runs before the partner IP rule.
This guarantees that malicious requests are blocked before the partner IP's allow action can be evaluated.

Key Concept

AWS WAF sequential rule evaluation and terminating actions
Rate this question

Topics

Strengthening Identity, Access, and Network Security