Examkin

Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

A company has an existing e-commerce web application fronted by an Application Load Balancer (ALB). The application has recently experienced distributed SQL injection (SQLi) attacks. To strengthen the network security posture, the company deploys an AWS WAF Web ACL associated with the ALB. The architect must configure the Web ACL to block known malicious IP addresses, block SQLi patterns, and allow all other normal web traffic. Additionally, the configuration must allow all requests from a trusted external inventory system's static IP range, bypassing SQLi inspection to prevent false positives. Which configuration should the architect implement to meet these requirements?

  1. Configure the Web ACL with a default action of Allow. Create a rule at Priority 1 to block known malicious IPs, a rule at Priority 2 to allow the trusted external IP range, and a rule at Priority 3 to block SQLi patterns.Cevap
  2. B
    Configure the Web ACL with a default action of Allow. Create a rule at Priority 1 to block SQLi patterns, a rule at Priority 2 to block known malicious IPs, and a rule at Priority 3 to allow the trusted external IP range.
  3. C
    Configure the Web ACL with a default action of Block. Create a rule at Priority 1 to allow the trusted external IP range, a rule at Priority 2 to block known malicious IPs, and a rule at Priority 3 to block SQLi patterns.
  4. D
    Configure the Web ACL with a default action of Allow. Create a rule at Priority 1 to block known malicious IPs, a rule at Priority 2 to block SQLi patterns, and a rule at Priority 3 to allow the trusted external IP range.

Cevap

Configure the Web ACL with a default action of Allow. Create a rule at Priority 1 to block known malicious IPs, a rule at Priority 2 to allow the trusted external IP range, and a rule at Priority 3 to block SQLi patterns.
Evaluating rules in AWS WAF occurs in order of priority (from lowest numerical value to highest). Once a rule matches a request with a terminating action (like Allow or Block), the evaluation of subsequent rules stops. By placing the rule to block known malicious IPs at Priority 1, we ensure malicious traffic is blocked immediately. Placing the rule to allow the trusted external IP range at Priority 2 ensures that requests from this range terminate evaluation with an Allow action, thereby bypassing the SQLi block rule at Priority 3. Finally, setting the default action to Allow ensures that all other traffic not matching the block rules is permitted.

Adım Adım Çözüm

1
Analyze WAF rule evaluation mechanics.
AWS WAF evaluates rules in priority order (lowest number first). Terminating actions (Allow/Block) stop further evaluation.
To design the correct priority list, we must know how traffic matches rules and terminates.
2
Order the requirements to prevent false positives and block malicious traffic.
First, block known bad actors (malicious IPs). Second, allow the trusted partner IP range to bypass further checks. Third, inspect remaining traffic for SQLi and block matches.
This ensures trusted traffic never reaches the SQLi inspection rule, while malicious traffic is dropped first.
3
Determine the default Web ACL action.
Set the default action to Allow to let normal traffic through after it passes the blocklist and SQLi filters.
An Allow default action permits all traffic that is not explicitly blocked or allowed early.

Anahtar Kavram

AWS WAF Rule Priority and Evaluation Logic
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security