SCS-C02 · Question #463
A company has a new web-based account management system for an online game. Players create a unique username and password to log in to the system. The company has implemented an AWS WAF web ACL for…
The correct answer is A. Create an Amazon CloudWatch custom metric to analyze the number of successful login B. Add the account takeover prevention (ATP) AWS managed rule group to the web ACL. Creating a CloudWatch custom metric to monitor the number of successful login responses from a single IP address can help identify unusual patterns that might indicate credential stuffing. This allows for additional monitoring and detection without immediately impacting…
Question
A company has a new web-based account management system for an online game. Players create a unique username and password to log in to the system. The company has implemented an AWS WAF web ACL for the system. The web ACL includes the core rule set (CRS) AWS managed rule group on the Application Load Balancer that serves the system. The company's security team finds that the system was the target of a credential stuffing attack. Credentials that were exposed in other breaches were used to try to log in to the system. The security team must implement a solution to reduce the chance of a successful credential stuffing attack in the future. The solution also must minimize impact on legitimate users of the system. Which combination of actions will meet these requirements? (Choose two.)
Options
- ACreate an Amazon CloudWatch custom metric to analyze the number of successful login
- BAdd the account takeover prevention (ATP) AWS managed rule group to the web ACL.
- CConfigure a default web ACL action that requires all users to solve a CAPTCHA puzzle when they
- DImplement IP-based match rules in the web ACL for any IP addresses that generate many
- ECreate a custom block response that redirects users to a secure workflow to reset their password
How the community answered
(42 responses)- A74% (31)
- C7% (3)
- D2% (1)
- E17% (7)
Explanation
Creating a CloudWatch custom metric to monitor the number of successful login responses from a single IP address can help identify unusual patterns that might indicate credential stuffing. This allows for additional monitoring and detection without immediately impacting legitimate users. The AWS WAF Account Takeover Prevention (ATP) rule group is specifically designed to detect and mitigate credential stuffing attacks. By configuring ATP to inspect login requests and blocking requests with the awswaf:managed:aws:atp:signal:credential_compromised label, the security team can significantly reduce the chances of successful credential stuffing attacks. This approach targets compromised credentials while minimizing impact on legitimate users.
Topics
Community Discussion
No community discussion yet for this question.