Examkin

Soru

Zorluk: OrtaThreat Protection and Web Application Firewall (WAF)

An organization's web application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application receives traffic forwarded from a third-party Content Delivery Network (CDN) provider. A SysOps administrator is configuring an AWS WAF Web ACL associated with the ALB to mitigate brute-force attempts on the login portal located at /admin/login. Because the CDN routes all traffic, the source IP of all incoming HTTP requests to the ALB is that of the CDN edge servers. The client's actual IP address is preserved in the X-Forwarded-For HTTP header.

Which of the following configuration steps should the administrator perform on the rate-based rule to block malicious clients while minimizing impact on legitimate traffic? (Select TWO.)

  1. Configure the rate-based rule to evaluate the IP address found in the X-Forwarded-For header.Cevap
  2. Define a scope-down statement within the rate-based rule to only match requests where the URI path is /admin/login.Cevap
  3. C
    Configure an inbound Rule on the subnet Network Access Control List (NACL) to evaluate the HTTP header.
  4. D
    Create a Route 53 Alias record to inspect the request path and dynamic header before routing traffic to the Application Load Balancer.
  5. E
    Create an Amazon CloudWatch alarm based on ALB metrics to trigger an AWS Systems Manager Automation runbook that blocks individual client IPs.

Cevap

To mitigate the brute-force attempts under these conditions, configure the rate-based rule to evaluate the IP address found in the X-Forwarded-For header, and define a scope-down statement within the rate-based rule to only match requests where the URI path is /admin/login.
Evaluating the IP address in the X-Forwarded-For header is required to correctly identify the client when a CDN proxy sits in front of the application. Additionally, a scope-down statement targeting the /admin/login path ensures that the rate limit only tracks requests to the login page, protecting the rest of the application from inadvertent blocks.

Adım Adım Çözüm

1
Configure the rate-based rule IP source evaluation settings.
AWS WAF is set to parse the IP address in the X-Forwarded-For HTTP header.
Since traffic is routed through a third-party CDN, the default source IP option would incorrectly count all requests as originating from the CDN edge server. Using the header evaluates the actual client IP.
2
Add a scope-down statement to the rate-based rule configuration.
The rate-based rule only counts requests matching the specified URI path constraint.
Applying the rate limit without a scope-down statement would count all requests to any page on the web application, leading to false-positive blocks for legitimate users who browse multiple pages.

Anahtar Kavram

Configuring AWS WAF rate-based rules with forwarded IP headers and scope-down statements in proxied environments.
Bu soruyu puanla

Konular

Threat Protection and Web Application Firewall (WAF)

Bu konudan daha fazla soru