Examkin

Question

Difficulty: MediumThreat Protection and Web Application Firewall (WAF)

A SysOps administrator is managing a web application's regional REST API hosted on Amazon API Gateway. During peak traffic hours, the API suffers from performance degradation due to a high volume of HTTP flood requests originating from a distributed set of IP addresses. The administrator needs to configure AWS WAF to mitigate these web-layer DDoS attacks. Additionally, to comply with strict storage cost optimization guidelines, only requests that are actively blocked by AWS WAF rules must be logged.

Which TWO configuration steps must the SysOps administrator implement to meet these requirements? (Select TWO.)

  1. Add a rate-based rule to the Web ACL that evaluates requests based on the client IP address, and set the rule action to Block.Answer
  2. Enable logging for the Web ACL and configure a logging filter that specifies a rule action of Block as the logging condition.Answer
  3. C
    Configure a stateless Network ACL rule on the public subnets to block the offending IP addresses.
  4. D
    Enable AWS CloudTrail data event logging on the API Gateway and create a CloudWatch log retention policy of 24 hours to automatically purge logs.
  5. E
    Configure the Web ACL to send logs to an Amazon S3 bucket encrypted with an AWS KMS customer managed key, using an IAM user policy to grant write access to AWS WAF.

Answer

The SysOps administrator should add a rate-based rule to the Web ACL to block clients exceeding request thresholds, and enable logging for the Web ACL with a logging filter that only records requests with a Block action.
To mitigate HTTP flood attacks from a distributed set of IP addresses, a rate-based rule should be added to the Web ACL to automatically track request rates and block IPs that exceed the threshold. To optimize storage costs, a logging filter should be set up on the Web ACL to specify that only requests matching the Block action are published to the log destination, dropping all other allowed traffic logs.

Step-by-Step Solution

1
Implement threat protection using AWS WAF by creating a rate-based rule to monitor request volumes from individual IP addresses over a sliding window, blocking those that exceed the limit.
Dynamic client IP addresses causing the HTTP flood are automatically throttled and blocked.
Rate-based rules are the standard AWS WAF feature for mitigating application-layer (Layer 7) DDoS/HTTP flood attacks.
2
Configure AWS WAF logging and direct the logs to a supported destination (such as CloudWatch Logs, an S3 bucket, or Kinesis Data Firehose).
A logging pipeline is established to capture Web ACL request metadata.
Logging must be enabled on the Web ACL before filters can be applied to manage the destination data volume.
3
Define a logging filter on the Web ACL configuration that evaluates the rule action of each request and drops logs that do not match the Block action.
Only log entries for requests blocked by AWS WAF are published to the destination, filtering out allowed traffic logs.
This configuration minimizes log storage requirements and associated costs by preventing allowed traffic logs from being generated.

Key Concept

AWS WAF threat mitigation via rate-based rules combined with logging cost optimization using logging filters.
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic