Examkin

Question

Difficulty: MediumThreat Protection and Web Application Firewall (WAF)

A company's web application is distributed globally using an Amazon CloudFront distribution protected by an AWS WAF web ACL. The application has recently experienced an HTTP flood attack targeting the feedback submission endpoint at `/submit-feedback`. A SysOps administrator needs to configure AWS WAF to block requests to `/submit-feedback` from any client IP address that exceeds 200 requests within a 5-minute period, while ensuring that legitimate traffic to other pages and endpoints on the website is not rate-limited or blocked.

Which configuration should the SysOps administrator implement to meet these requirements?

  1. Create an AWS WAF rate-based rule with a rate limit of 200. Configure a scope-down statement within the rule to only inspect requests where the URI path matches `/submit-feedback`, and set the rule action to Block.Answer
  2. B
    Create an AWS WAF rate-based rule with a rate limit of 200. Associate a custom Amazon EventBridge rule that monitors AWS CloudTrail logs for WAF metrics to trigger an AWS Lambda function that dynamically adds offending client IPs to an IP set blocklist.
  3. C
    Create a stateless Network Access Control List (NACL) rule in the VPC containing the origin servers that denies traffic from any IP address making more than 200 requests per 5 minutes to the `/submit-feedback` path.
  4. D
    Configure an Amazon Route 53 failover routing policy that redirects traffic to a backup static page if health checks detect that the rate of requests to `/submit-feedback` exceeds 200 per 5 minutes.

Answer

Create an AWS WAF rate-based rule with a rate limit of 200. Configure a scope-down statement within the rule to only inspect requests where the URI path matches `/submit-feedback`, and set the rule action to Block.
The correct configuration is to implement a rate-based rule with a scope-down statement. AWS WAF rate-based rules track the number of incoming requests from each IP address over a sliding 5-minute window. By adding a scope-down statement matching the `/submit-feedback` URI, the administrator ensures that the rate limit of 200 is only counted against requests heading to that specific endpoint. Once a client IP exceeds this threshold, AWS WAF blocks further requests from that IP address, preventing the resource exhaustion attack while leaving other traffic untouched.

Step-by-Step Solution

1
Open the AWS WAF console, locate the web ACL associated with the Amazon CloudFront distribution, and add a custom rule.
A new custom rule definition wizard is opened within the selected web ACL.
AWS WAF web ACLs must be modified to apply new rules protecting the CloudFront distribution.
2
Define the rule type as a 'Rate-based rule' and set the rate limit threshold to 200 requests per 5 minutes.
AWS WAF is configured to track incoming request rates for individual client IP addresses.
This sets the threshold for rate-limiting, which dictates when a client IP will be blocked.
3
Configure a scope-down statement inside the rate-based rule with a condition matching the URI path equal to `/submit-feedback`.
AWS WAF only increments the request counter for a client IP when that client accesses the specific path.
This ensures that traffic to other parts of the website is excluded from the rate-limiting calculations, preventing false positives for normal users browsing the site.
4
Set the default rule action to 'Block' and save the rule.
The rule is deployed to the edge locations, blocking traffic from offending IPs to the `/submit-feedback` page once they exceed the limit.
This mitigates the HTTP flood attack at the AWS edge before it reaches the backend origin servers.

Key Concept

AWS WAF Rate-Based Rules and Scope-Down Statements
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic