An enterprise hosts an internal web application on Amazon EC2 instances behind an internal… — AWS Certified Solutions Architect - Professional

An enterprise hosts an internal web application on Amazon EC2 instances behind an internal Application Load Balancer (ALB) inside a VPC. Corporate users access the application through an AWS Site-to-Site VPN connection. The security team wants to improve the network security posture by deploying AWS WAF on the internal ALB. The requirements are:

1. Block all requests containing SQL injection (SQLi) patterns.
2. Restrict all other access to the corporate network public CIDR block ( $203.0.113.0/24$ ).

The security team configures an AWS WAF WebACL with the following rules:
- Rule A (Priority 10): A custom rule with an Allow action for source IP addresses in $203.0.113.0/24$ .
- Rule B (Priority 20): An AWS Managed Rules SQL database rule set with a Block action.
- Default Action: Block.

During a security audit, simulated SQLi attacks originating from the corporate network successfully reach the EC2 instances. Which of the following modifications should the security team perform to remediate this vulnerability and meet the requirements? (Select TWO.)

Increase the priority value of Rule A so that it is evaluated after Rule B (e.g., set Rule A to Priority 30).Cevap
Modify Rule A to block traffic that does not originate from $203.0.113.0/24$ , set its priority to 30, and change the WebACL default action to Allow.Cevap
C
Change the action of Rule A to Count, keep its priority at 10, and keep the WebACL default action as Block.
D
Modify Rule A to block traffic that does not originate from $203.0.113.0/24$ , keep its priority at 10, and keep the WebACL default action as Block.
E
Change the action of Rule B to Count and change its priority to 5, allowing all corporate network traffic to be allowed by Rule A.

Cevap

To remediate the vulnerability, increase the priority value of Rule A so that it is evaluated after Rule B, or modify Rule A to block traffic that does not originate from the corporate network CIDR block, set its priority to 30, and change the WebACL default action to Allow.

AWS WAF evaluates rules in order of priority, starting from the lowest number. If a rule matches with an Allow or Block action, evaluation terminates. In the initial configuration, Rule A (Priority 10, Allow corporate IP) matches first for all traffic from the corporate IP, including SQLi attacks, preventing Rule B (Priority 20, SQLi Block) from ever being evaluated. To remediate this, evaluating Rule B (SQLi Block) first at a higher priority (lower priority number) than Rule A ensures SQLi payloads are blocked first. Legitimate corporate traffic then falls through to Rule A where it is allowed, while other traffic falls through to the default Block action. Alternatively, configuring Rule A to block traffic not originating from the corporate IP at a lower priority than Rule B, and changing the default action to Allow, ensures SQLi is blocked first by Rule B. Then, external traffic is blocked by Rule A, and legitimate corporate traffic safely falls through to the default Allow action.

Adım Adım Çözüm

Analyze the rule evaluation order of AWS WAF.

AWS WAF processes rules sequentially starting from the lowest priority value. If a request matches a rule with an Allow or Block action, processing stops immediately.

This helps determine why the SQLi attacks from the corporate IP are bypassing Rule B (priority 20) by matching Rule A (priority 10, Allow) first.

Evaluate the impact of changing rule priorities to block malicious traffic first.

By moving Rule A to a lower priority (higher priority number, e.g., 30) than Rule B (priority 20), SQLi checks are performed first. Malicious requests are blocked by Rule B, while clean requests from the corporate IP fall through to Rule A and are allowed.

This addresses the primary vulnerability while still allowing legitimate corporate traffic.

Evaluate an alternative logic path using block rules and default actions.

If Rule A is modified to block traffic NOT originating from the corporate IP (at Priority 30) and the default action is set to Allow, Rule B (Priority 20) still blocks SQLi first. Then, Rule A blocks non-corporate traffic, and clean corporate traffic falls through to the default Allow action.

This satisfies the requirements by using negative matching (blocking non-corporate traffic) and an Allow default action.

Anahtar Kavram

AWS WAF Rule Evaluation Order and Action Behaviors

Tahmini Süre:2m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular