Examkin

Question

Difficulty: HardThreat Protection and Web Application Firewall (WAF)

A company hosts a high-traffic API on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is integrated with an AWS WAF Web ACL that logs all web requests to an Amazon CloudWatch Logs log group. Due to the high volume of traffic, the CloudWatch Logs ingestion and storage costs have exceeded the budget. The security team requires that only requests that are explicitly blocked by the Web ACL be retained for analysis. Which action should the SysOps administrator take to meet these requirements with the least operational effort?

  1. A
    Replace the AWS WAF rules with Network Access Control List (NACL) rules at the subnet level to deny malicious IPs, and configure VPC Flow Logs to record the blocked traffic.
  2. B
    Create a CloudWatch Logs metric filter that matches the WAF BLOCK action to record occurrences as a metric, and decrease the CloudWatch Logs log group retention period to 1 day.
  3. Configure a logging filter in the AWS WAF logging configuration. Define a filter rule that matches the BLOCK action to keep the logs, and set the default behavior to drop logs for all other requests.Answer
  4. D
    Configure an AWS CloudTrail trail to log Application Load Balancer data events, write the logs to an Amazon S3 bucket, and apply a KMS key policy to restrict access while disabling AWS WAF logging.

Answer

Configure a logging filter in the AWS WAF logging configuration. Define a filter rule that matches the BLOCK action to keep the logs, and set the default behavior to drop logs for all other requests.
Configuring a logging filter directly in AWS WAF allows filtering out requests before they are sent to CloudWatch Logs. By matching the BLOCK action and keeping only those logs while dropping all others, ingestion and storage costs are minimized while satisfying the security requirement.

Step-by-Step Solution

1
Identify the target for cost optimization, which is reducing the volume of AWS WAF logs ingested by CloudWatch Logs.
Determined that allowed web requests contribute to the majority of log volume and should be excluded at the source.
Ingestion costs in CloudWatch Logs are charged per gigabyte, meaning filtering must occur prior to log delivery.
2
Evaluate native filtering capabilities within the AWS WAF logging configuration.
Selected AWS WAF logging filters to filter requests based on rule action parameters.
AWS WAF supports native log filtering, which incurs no additional processing layer or external utility costs.
3
Configure the logging filter to match the security team's specification.
Created a filter rule matching the BLOCK action set to KEEP, and configured the default behavior to DROP.
This configuration ensures only blocked requests are sent to the CloudWatch Logs log group, lowering ingestion and storage costs.

Key Concept

AWS WAF Log Filtering
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic