Examkin

Question

Difficulty: MediumThreat Protection and Web Application Firewall (WAF)

A company's regional API Gateway REST API is protected by an AWS WAF Web ACL. During a security audit, the SysOps administrator identifies a brute-force attempt targeting the `/checkout` endpoint. To mitigate this threat, the administrator must restrict each client IP address to a maximum of 100100 requests per 55 minutes on the `/checkout` path only. Traffic to other endpoints must not be affected.

Which configuration should the SysOps administrator implement to meet these requirements?

  1. A
    Deploy stateless Network Access Control List (NACL) rules on the VPC subnets to limit traffic to 100100 requests per 55 minutes, ensuring outbound rules restrict traffic to only HTTPS port 443443.
  2. Create an AWS WAF Web ACL rule with a rate-based statement set to a limit of 100100, and configure a scope-down statement that matches the URI path `/checkout`.Answer
  3. C
    Configure an Amazon CloudWatch metric filter for the `/checkout` path that triggers an AWS Config remediation rule, which directly executes an Amazon EventBridge rule to update the API Gateway resource policy.
  4. D
    Modify the API Gateway backend Application Load Balancer target group health check configuration, changing the health check path to `/checkout` and adjusting the threshold to mark targets unhealthy when requests exceed 100100 per 55 minutes.

Answer

Create an AWS WAF Web ACL rule with a rate-based statement set to a limit of 100100, and configure a scope-down statement that matches the URI path `/checkout`.
The correct option correctly uses an AWS WAF rate-based rule with a scope-down statement matching the `/checkout` URI. AWS WAF evaluates the request rate per client IP address over a sliding 55-minute window and blocks traffic exceeding 100100 requests on that path, satisfying the requirements without affecting other endpoints.

Step-by-Step Solution

1
Select the AWS WAF Web ACL associated with the regional API Gateway.
The Web ACL configuration page is opened.
Threat protection rules must be configured directly within the Web ACL protecting the target API Gateway.
2
Add a new rule with a rate-based statement set to a threshold of 100100 requests.
The rule is set up to count requests per client IP address over a sliding 55-minute window.
This establishes the client-based rate limiting required to mitigate brute-force attempts.
3
Configure a scope-down statement within the rate-based rule to evaluate only requests where the URI path matches `/checkout`.
Only requests targeting the `/checkout` path will count towards the rate limit.
This ensures that traffic to other API paths remains unaffected by the rate-based rule.

Key Concept

AWS WAF rate-based rules evaluate the rate of requests from client IP addresses. To apply rate limiting to a subset of requests, a scope-down statement restricts evaluation to matching criteria, such as a specific URI path.
Estimated Time:1m 30s
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic