Examkin

Question

Difficulty: Very hardThreat Protection and Web Application Firewall (WAF)

A digital media platform distributes content globally via an Amazon CloudFront distribution. A SysOps administrator must defend the platform against application-layer DDoS attacks using AWS WAF. A partner organization crawls the platform for metadata updates from a known set of static IP addresses.

The administrator must implement a rate limit of 20002{}000 requests per 5 minutes for all incoming client connections, while ensuring the partner's crawler is not affected by this limit and remains subject to all other security rules in the Web ACL. Additionally, the administrator must minimize the storage costs and ingestion fees of WAF logs in Amazon S3 by only recording traffic that is blocked by the Web ACL.

Which two actions must the administrator take to meet these requirements?

  1. Create an IP set containing the partner's IP addresses. In the rate-based rule configuration, set the scope of inspection to evaluate only requests that do not match the IP set.Answer
  2. Enable WAF logging with Amazon Kinesis Data Firehose as the destination. Configure WAF log filtering with a rule action of Keep when the terminating rule action is Block.Answer
  3. C
    Create an IP set containing the partner's IP addresses. Create a rule with an Allow action and a higher priority than the rate-based rule, and configure it to match the partner's IP set.
  4. D
    Enable WAF logging to an Amazon S3 bucket, and configure an Amazon S3 lifecycle policy to transition all log files directly to Amazon S3 Glacier Deep Archive after 1 day.
  5. E
    Enable WAF logging with Amazon CloudWatch Logs as the destination. Create a metric filter on the log group to capture only Block actions, and set the log group retention period to 1 day.

Answer

To meet the requirements, the administrator should create an IP set containing the partner's IP addresses and set the scope of inspection in the rate-based rule configuration to evaluate only requests that do not match the IP set. Additionally, WAF logging should be enabled with Amazon Kinesis Data Firehose as the destination, and WAF log filtering should be configured with a Keep action when the terminating rule action is Block.
To exclude the partner's static IPs from the rate limit without bypassing other Web ACL rules, the administrator must configure a scope-down statement within the rate-based rule to only evaluate requests that do not match the partner's IP set. To reduce costs, the administrator should enable WAF logging to Kinesis Data Firehose and configure log filtering to only 'Keep' logs where the terminating rule action is Block, dropping all allowed request logs at the source.

Step-by-Step Solution

1
Exempt the partner's traffic from the rate-limiting rule without exempting them from other security rules.
Create an IP Set with the partner's IP addresses and apply a scope-down statement containing a logical NOT condition in the rate-based rule configuration.
Since WAF evaluates rules sequentially and an Allow rule terminates evaluation, a scope-down statement inside the rate-based rule itself is required to exclude the partner's IP set while keeping their traffic subject to other rules in the Web ACL.
2
Configure WAF logging to filter allowed traffic and only capture blocked traffic.
Enable WAF logging to Amazon Kinesis Data Firehose and configure WAF log filtering with a rule action of Keep when the terminating rule action is Block.
This filters and drops logs at the source, preventing unnecessary data from being ingested by Kinesis Firehose and written to S3, reducing both ingestion and storage costs.

Key Concept

AWS WAF Scope-Down Statements and Log Filtering
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic