Examkin

Question

Difficulty: MediumThreat Protection and Web Application Firewall (WAF)

A company hosts an API on Amazon EC2 instances behind an Application Load Balancer (ALB), which is protected by an AWS WAF Web ACL. A SysOps administrator notices that legitimate API clients receive HTTP 403 Forbidden responses when uploading payload files larger than 64 KB64\text{ KB}. The AWS WAF logs indicate that these requests are blocked by a custom rule designed to inspect the request body for SQL injection (SQLi) attacks. The administrator needs to ensure that clients can upload large payloads while maintaining SQLi threat protection on the inspectable portion of the request body. Which configuration change should the administrator implement to meet these requirements?

  1. A
    Create an outbound Network ACL rule on the application subnets that allows ephemeral port traffic for payloads exceeding 64 KB64\text{ KB}.
  2. Modify the custom SQLi rule and set the request body oversize handling setting to Continue.Answer
  3. C
    Increase the CloudWatch metric resolution to detailed monitoring (1-minute intervals) for the ALB to handle larger request streams.
  4. D
    Configure a Route 53 CNAME record pointing to an S3 bucket to offload the large files before they reach the ALB.

Answer

Modify the custom SQLi rule and set the request body oversize handling setting to Continue.
Setting the request body oversize handling to 'Continue' allows AWS WAF to inspect the request up to the maximum inspectable size (which is 64 KB64\text{ KB} for Application Load Balancers) and evaluate it against the rule. The rest of the payload is ignored by this specific rule, but the request itself is not automatically blocked, allowing legitimate large uploads to proceed.

Step-by-Step Solution

1
Analyze the AWS WAF logs to identify why requests exceeding 64 KB64\text{ KB} are blocked.
The logs confirm the custom SQL injection (SQLi) rule is blocking the requests because the body size exceeds the WAF inspection limit for Application Load Balancers.
Before making changes, the administrator must verify which specific rule and limit are triggering the block.
2
Locate the custom SQLi rule in the Web ACL configuration and evaluate its oversize handling setting.
The rule's oversize handling is set to Match or Block, causing any request exceeding the 64 KB64\text{ KB} body limit to be treated as a match and blocked.
By default, if oversize handling is not set to Continue, WAF will block requests that exceed the inspectable size limit when the rule action is set to Block.
3
Update the oversize handling configuration of the custom SQLi rule to Continue.
AWS WAF will now inspect the first 64 KB64\text{ KB} of the request body for SQLi threats and allow the request to proceed without evaluating the remainder of the payload.
This configuration meets the requirement to allow large uploads while maintaining security inspection on the first part of the payload.

Key Concept

AWS WAF Body Inspection Limits and Oversize Handling
Estimated Time:1m 30s
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic