SCS-C02 · Question #136
A company is using AWS WAF to protect a customized public API service that is based on Amazon EC instances. The API uses an Application Load Balancer. The AWS WAF web ACL is configured with an AWS…
The correct answer is A. Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine. Option A is correct because switching the WAF rules to Count action immediately stops blocking requests and returns the application to service - Count logs matched requests without dropping them, which is the fastest way to restore availability while you investigate which rules…
Question
A company is using AWS WAF to protect a customized public API service that is based on Amazon EC instances. The API uses an Application Load Balancer. The AWS WAF web ACL is configured with an AWS Managed Rules rule group. After a software upgrade to the API and the client application, some types of requests are no longer working and are causing application stability issues. A security engineer discovers that AWS WAF logging is not turned on for the web ACL. The security engineer needs to immediately return the application to service, resolve the issue, and ensure that logging is not turned off in the future. The security engineer turns on logging for the web ACL and specifies Amazon CloudWatch Logs as the destination. Which additional set of steps should the security engineer take to meet the requirements?
Options
- AEdit the rules in the web ACL to include rules with Count actions. Review the logs to determine
- BEdit the rules in the web ACL to include rules with Count actions. Review the logs to determine
- CEdit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs
- DEdit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs
How the community answered
(45 responses)- A82% (37)
- B2% (1)
- C4% (2)
- D11% (5)
Explanation
Option A is correct because switching the WAF rules to Count action immediately stops blocking requests and returns the application to service - Count logs matched requests without dropping them, which is the fastest way to restore availability while you investigate which rules are incorrectly matching the upgraded API traffic. Once CloudWatch Logs captures the traffic patterns, the engineer can identify the specific rules causing false positives and tune them before re-enabling Block actions.
Why C and D are wrong: Adding Challenge actions (CAPTCHA/JavaScript challenges) still disrupts end users - they introduce friction or require browser interaction, so the application is not immediately "returned to service." Challenge is appropriate for bot mitigation, not for diagnosing rule conflicts after a software upgrade.
Why B is wrong: B likely proposes an incorrect mechanism for enforcing that logging remains enabled in the future (e.g., relying on IAM alone or a manual process), whereas A uses the correct AWS-native control - an AWS Config rule (such as waf-regional-logging-enabled) that continuously evaluates the WAF web ACL and automatically remediates or alerts if logging is ever disabled.
Memory tip: Think of it as a two-phase fix - Count first to unblock, Config to lock it in. Count = "watch but don't block" (restores service); AWS Config = "enforce and audit" (prevents future drift). Challenge is for humans vs. bots, not for debugging rule behavior.
Topics
Community Discussion
No community discussion yet for this question.