SCS-C02 · Question #427
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack by a specific IoT device brand that has a…
The correct answer is D. Use a string match rule statement that includes details of the IoT device brand from the user. By using a string match rule in AWS WAF that targets the unique user agent of the IoT device brand, the security engineer can specifically block requests from those devices while allowing legitimate customer traffic. This approach directly addresses the current DDoS attack by…
Question
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The security engineer must implement a rule statement as part of the web ACL to block the requests. The rule statement must mitigate the current attack and future attacks from these IoT devices without blocking requests from customers. Which rule statement will meet these requirements?
Options
- AUse an IP set match rule statement that includes the IP address for IoT devices from the user
- BUse a geographic match rule statement. Configure the statement to block countries that the IoT
- CUse a rate-based rule statement. Set a rate limit that is equal to the number of requests that are
- DUse a string match rule statement that includes details of the IoT device brand from the user
How the community answered
(43 responses)- A7% (3)
- B2% (1)
- C12% (5)
- D79% (34)
Explanation
By using a string match rule in AWS WAF that targets the unique user agent of the IoT device brand, the security engineer can specifically block requests from those devices while allowing legitimate customer traffic. This approach directly addresses the current DDoS attack by matching the user agent string, which is unique to the malicious devices, and ensures future attacks by the same type of IoT devices are blocked as well. This rule is precise and avoids affecting legitimate users.
Topics
Community Discussion
No community discussion yet for this question.