Examkin

Soru

Zorluk: OrtaThreat Protection and Web Application Firewall (WAF)

A company's regional API Gateway REST API is protected by an AWS WAF Web ACL. During a security audit, the SysOps administrator identifies a brute-force attempt targeting the `/checkout` endpoint. To mitigate this threat, the administrator must restrict each client IP address to a maximum of 100100 requests per 55 minutes on the `/checkout` path only. Traffic to other endpoints must not be affected.

Which configuration should the SysOps administrator implement to meet these requirements?

  1. A
    Deploy stateless Network Access Control List (NACL) rules on the VPC subnets to limit traffic to 100100 requests per 55 minutes, ensuring outbound rules restrict traffic to only HTTPS port 443443.
  2. Create an AWS WAF Web ACL rule with a rate-based statement set to a limit of 100100, and configure a scope-down statement that matches the URI path `/checkout`.Cevap
  3. C
    Configure an Amazon CloudWatch metric filter for the `/checkout` path that triggers an AWS Config remediation rule, which directly executes an Amazon EventBridge rule to update the API Gateway resource policy.
  4. D
    Modify the API Gateway backend Application Load Balancer target group health check configuration, changing the health check path to `/checkout` and adjusting the threshold to mark targets unhealthy when requests exceed 100100 per 55 minutes.

Cevap

Create an AWS WAF Web ACL rule with a rate-based statement set to a limit of 100100, and configure a scope-down statement that matches the URI path `/checkout`.
The correct option correctly uses an AWS WAF rate-based rule with a scope-down statement matching the `/checkout` URI. AWS WAF evaluates the request rate per client IP address over a sliding 55-minute window and blocks traffic exceeding 100100 requests on that path, satisfying the requirements without affecting other endpoints.

Adım Adım Çözüm

1
Select the AWS WAF Web ACL associated with the regional API Gateway.
The Web ACL configuration page is opened.
Threat protection rules must be configured directly within the Web ACL protecting the target API Gateway.
2
Add a new rule with a rate-based statement set to a threshold of 100100 requests.
The rule is set up to count requests per client IP address over a sliding 55-minute window.
This establishes the client-based rate limiting required to mitigate brute-force attempts.
3
Configure a scope-down statement within the rate-based rule to evaluate only requests where the URI path matches `/checkout`.
Only requests targeting the `/checkout` path will count towards the rate limit.
This ensures that traffic to other API paths remains unaffected by the rate-based rule.

Anahtar Kavram

AWS WAF rate-based rules evaluate the rate of requests from client IP addresses. To apply rate limiting to a subset of requests, a scope-down statement restricts evaluation to matching criteria, such as a specific URI path.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Threat Protection and Web Application Firewall (WAF)

Bu konudan daha fazla soru