Examkin

Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

A company hosts a web application on AWS ECS Fargate behind an Application Load Balancer (ALB). The security team wants to strengthen the network security posture of this existing application by implementing AWS WAF. The solution must meet the following requirements:
1. Immediately block traffic from known malicious IP addresses.
2. Protect the application against SQL injection (SQLi) attacks.
3. Rate-limit general client requests to 120 requests per minute.
4. Allow a specific business partner's static IP range to bypass the rate limit, while ensuring their traffic is still inspected for SQLi.

Which of the following configuration strategies for the AWS WAF Web ACL rules meets these security requirements?

  1. Configure the Web ACL with Priority 1: SQLi block rule (Block action), Priority 2: Malicious IP block rule (Block action), Priority 3: Partner IP rule (Allow action), Priority 4: Rate-limiting rule (Block action), and Default Action: Allow.Cevap
  2. B
    Configure the Web ACL with Priority 1: Partner IP rule (Allow action), Priority 2: SQLi block rule (Block action), Priority 3: Malicious IP block rule (Block action), Priority 4: Rate-limiting rule (Block action), and Default Action: Allow.
  3. C
    Create a Service Control Policy (SCP) in AWS Organizations to allow the partner IP range and block requests exceeding the rate limit or containing SQLi signatures, then apply it to the member account hosting the application.
  4. D
    Deploy an AWS Transit Gateway routing configuration that inspects and drops traffic containing SQLi or exceeding the rate limit before the traffic is routed to the Application Load Balancer.

Cevap

Configure the Web ACL with Priority 1: SQLi block rule (Block action), Priority 2: Malicious IP block rule (Block action), Priority 3: Partner IP rule (Allow action), Priority 4: Rate-limiting rule (Block action), and Default Action: Allow.
The correct strategy places the SQLi block and malicious IP block rules at the highest priorities (Priority 1 and 2), followed by the partner IP allow rule (Priority 3), and finally the rate-limiting rule (Priority 4). Since AWS WAF evaluates rules sequentially, a partner request is first inspected for SQLi. If it is safe, it matches the partner IP rule, which has a terminating Allow action. This stops evaluation, allowing the request and ensuring it bypasses the rate-limiting rule at Priority 4. For general clients, they pass the partner rule and are successfully evaluated by the rate-limiting rule.

Adım Adım Çözüm

1
Identify the order of evaluation for AWS WAF rules.
AWS WAF processes rules sequentially starting from the lowest priority number (Priority 1).
Understanding rule precedence is critical because matching a rule with a terminating action (like Allow or Block) stops further rule evaluation.
2
Determine the placement of block rules versus allow rules.
SQLi block and malicious IP block must be evaluated before the partner allow rule.
If the partner rule is evaluated first, legitimate partner traffic containing malicious SQLi payloads would be allowed without inspection due to the terminating Allow action.
3
Determine the placement of the rate-limiting rule relative to the partner rule.
The rate-limiting rule must be evaluated after the partner allow rule.
A terminating Allow action for the partner IP stops evaluation, preventing it from hitting the subsequent rate-limiting rule, while general clients continue to be evaluated.

Anahtar Kavram

AWS WAF rule evaluation order and action behaviors
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security