Examkin

Question

Difficulty: HardThreat Protection and Web Application Firewall (WAF)

A SysOps administrator is configuring security protections for an AWS AppSync GraphQL API using AWS WAF. The administrator needs to protect the API from HTTP flood attacks from single client IP addresses, while ensuring that legitimate users are not blocked. The administrator also needs to log all blocked requests for security analysis, but must minimize Amazon CloudWatch Logs ingestion costs by excluding allowed requests from the logs.

Which two actions should the administrator take to meet these requirements? (Select TWO.)

  1. Create a rate-based rule in the Web ACL with a custom rate limit and set the rule action to Block.Answer
  2. Enable AWS WAF logging to Amazon CloudWatch Logs and configure a logging filter with a condition that matches the Block rule action.Answer
  3. C
    Create a stateless Network Access Control List (NACL) rule at the subnet level to drop traffic from IPs that exceed the request rate limit.
  4. D
    Configure an AWS Config rule that triggers an Amazon EventBridge event to run an AWS Systems Manager Automation runbook to delete allowed logs from the CloudWatch log group.
  5. E
    Configure CloudWatch detailed monitoring on the AppSync API and set up an alarm to trigger an AWS Lambda function that dynamically updates the subnet's route table.

Answer

Create a rate-based rule in the Web ACL with a custom rate limit set to Block, and configure AWS WAF logging to CloudWatch Logs with a logging filter matching the Block action.
To protect the AWS AppSync GraphQL API from HTTP flood attacks from single client IP addresses, the administrator should create a rate-based rule in the Web ACL with the action set to Block. This dynamically blocks requests from any IP address that exceeds the defined threshold within a 5-minute window. To minimize CloudWatch Logs ingestion costs, the administrator should enable WAF logging and configure a logging filter. The logging filter can be set with a condition that matches the Block rule action, which ensures that only blocked requests are written to the log group while allowed requests are dropped prior to ingestion.

Step-by-Step Solution

1
Add a rate-based rule to the Web ACL protecting the AWS AppSync API.
Requests from any single IP address that exceed the rate threshold are automatically blocked.
This protects the GraphQL API from HTTP flood attacks at the application layer.
2
Enable WAF logging and direct the logs to an Amazon CloudWatch Logs log group.
Log destination is configured, allowing access to logging filters.
This prepares the environment for custom logging criteria.
3
Configure a logging filter on the WAF Web ACL to match only requests with the Block action.
Only blocked requests are written to the log group, and allowed requests are filtered out before ingestion.
This minimizes logging costs by avoiding ingestion of logs for allowed web requests.

Key Concept

Implementing rate-based rules and optimizing logging costs via AWS WAF logging filters for application resources like AWS AppSync.
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic