Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise is improving the security posture of an existing web portal hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team attaches an AWS WAF WebACL to the ALB with the following requirements:
1. Block all requests containing SQL injection (SQLi) patterns.
2. Limit requests from any single IP address to a maximum of 2,000 requests per 5 minutes.
3. Allow an external partner's automated testing suite, which originates from a specific static IP range, to bypass the rate limit.

The WebACL is initially configured with the following rules:
- Priority 10: A rule matching the partner's IP address range with an action of Allow.
- Priority 20: An AWS Managed Rules SQL database rule group with an action of Block.
- Priority 30: A custom rate-based rule set to Block requests exceeding 2,000 per 5 minutes.
- Default Action: Allow.

During a penetration test, the partner successfully performs a SQL injection attack against the portal.

Which configuration change should the security team implement to resolve this vulnerability while meeting all requirements?

  1. Reorder the WebACL rules so that the SQL database rule group is evaluated at Priority 10, the partner's IP match rule (with an Allow action) is evaluated at Priority 20, and the rate-based rule (with a Block action) is evaluated at Priority 30.Answer
  2. B
    Change the action of the partner's IP match rule at Priority 10 to Count, while keeping the SQL database rule group at Priority 20 and the rate-based rule at Priority 30.
  3. C
    Reorder the WebACL rules so that the rate-based rule is evaluated at Priority 10, the partner's IP match rule (with an Allow action) is evaluated at Priority 20, and the SQL database rule group is evaluated at Priority 30.
  4. D
    Implement a Service Control Policy (SCP) at the AWS Organizations root to block SQL injection payloads at the Organization level, and remove the SQL database rule group from the WebACL.

Answer

Reorder the WebACL rules so that the SQL database rule group is evaluated at Priority 10, the partner's IP match rule (with an Allow action) is evaluated at Priority 20, and the rate-based rule (with a Block action) is evaluated at Priority 30.
Evaluating the SQL database rule group first ensures all requests are inspected for SQL injection. If a request is safe and originates from the partner's IP, the second rule matches and allows the traffic, terminating further evaluation and successfully bypassing the rate limit. All other traffic falls through to the rate-based rule.

Step-by-Step Solution

1
Analyze the execution flow of AWS WAF WebACL rules and the behavior of the Allow action.
AWS WAF rules are evaluated in priority order (lowest number first). A matching rule with a terminating action like Allow or Block stops further rule evaluation.
Understanding terminating actions is crucial to identifying why the SQLi vulnerability was bypassed for the partner's IP.
2
Determine the necessary ordering to prevent security bypasses while honoring exemptions.
The SQL injection protection rule must be evaluated before the partner's Allow rule. This ensures that any SQLi payloads are blocked first, regardless of the client IP.
This guarantees that no request can bypass the critical SQLi inspection.
3
Verify the position of the rate-limiting rule.
Place the rate-limiting rule after the partner's Allow rule. Legitimate traffic from the partner matches the Allow rule and terminates evaluation, avoiding the rate limit, while all other traffic falls through to the rate limit.
This satisfies the requirement to allow the partner to bypass the rate limit without exposing the application to SQLi from that partner.

Key Concept

AWS WAF WebACL rule evaluation priority and terminating actions for strengthening application security posture.
Rate this question

Topics

Strengthening Identity, Access, and Network Security