Examkin

Question

Difficulty: Very hardThreat Protection and Web Application Firewall (WAF)

A company hosts a web application behind an Application Load Balancer (ALB) protected by an AWS WAF Web ACL. The Web ACL contains the AWS Managed Rules Common Rule Set (AWSManagedRulesCommonRuleSet) to block common web exploits.

During a deployment, a SysOps Administrator notices that legitimate requests to an administrative API endpoint, /import/config, are being blocked with an HTTP 403 Forbidden error. Troubleshooting WAF logs reveals that these requests are matching the GenericLFI_BODY rule within the managed rule group, which flags local file inclusion patterns in the request body. The administrator must resolve this false positive to allow legitimate requests to /import/config while ensuring that the rest of the application remains protected by this rule.

Which configuration will resolve the issue with the least administrative effort?

  1. A
    Edit the settings of the AWS Managed Rules Common Rule Set. Add a scope-down statement directly to the GenericLFI_BODY rule definition that excludes the URI path /import/config from being evaluated by the rule.
  2. B
    Configure a Network Access Control List (NACL) rule for the ALB subnets to deny traffic from IP addresses that trigger the WAF rule. Use a custom AWS Lambda function triggered by Amazon CloudWatch Logs to dynamically update the NACL rules, excluding requests containing the /import/config URI path.
  3. Set the action of the GenericLFI_BODY rule within the AWSManagedRulesCommonRuleSet rule group to Count. Create a custom WAF rule in the Web ACL that evaluates after the managed rule group. Configure the custom rule to block requests that contain the awswaf:managed:aws:common-ruleset:GenericLFI_BODY label, unless the request's URI path matches /import/config.Answer
  4. D
    Create an AWS Config rule to monitor WAF Web ACL changes. Configure an Amazon EventBridge rule that detects when the GenericLFI_BODY rule is triggered, and runs an AWS Systems Manager (SSM) Automation document to temporarily disable the rule group when requests contain the /import/config path.

Answer

Set the action of the GenericLFI_BODY rule within the AWSManagedRulesCommonRuleSet rule group to Count. Create a custom WAF rule in the Web ACL that evaluates after the managed rule group. Configure the custom rule to block requests that contain the awswaf:managed:aws:common-ruleset:GenericLFI_BODY label, unless the request's URI path matches /import/config.
The correct configuration overrides the specific rule action to Count in the managed rule group and creates a custom rule evaluating after it. By overriding the rule to Count, AWS WAF does not block matching requests but still applies the label 'awswaf:managed:aws:common-ruleset:GenericLFI_BODY'. The custom rule then inspects this label using the HasLabel statement and blocks requests only if they do not match the exempted URI path (/import/config). This allows the administrator to handle the false positive precisely without compromising security on other paths.

Step-by-Step Solution

1
Override the action of the specific rule (GenericLFI_BODY) within the managed rule group (AWSManagedRulesCommonRuleSet) from Block to Count.
Requests matching the Local File Inclusion rule will no longer be blocked immediately, but AWS WAF will append the label 'awswaf:managed:aws:common-ruleset:GenericLFI_BODY' to the request metadata.
This allows subsequent custom rules in the Web ACL to inspect the label before deciding whether to allow or block the request.
2
Create a custom rule in the Web ACL that is positioned to evaluate after the managed rule group.
The custom rule evaluates requests that have already passed through the managed rule group and have been labeled.
Rule order is critical in AWS WAF; the label must be applied by the managed rule group before the custom rule tries to evaluate it.
3
Configure the custom rule using an AND statement that checks if the request has the label 'awswaf:managed:aws:common-ruleset:GenericLFI_BODY' AND does NOT match the URI path '/import/config', then set the action to Block.
Requests to '/import/config' that trigger the LFI rule are allowed to pass through, while all other requests triggering the LFI rule are blocked.
This isolates the exclusion specifically to the '/import/config' path, keeping the rest of the application protected from LFI exploits.

Key Concept

Handling false positives in AWS WAF Managed Rule Groups using Rule Action Overrides and WAF Labels.
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic