SCS-C03 · Question #113
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack by a specific IoT device brand that has a…
The correct answer is D. Use a string match rule statement that includes details of the IoT device brand from the user. AWS WAF allows security engineers to create string match rule statements that inspect specific parts of web requests, including HTTP headers such as the User-Agent header. According to the AWS Certified Security - Specialty Study Guide and AWS WAF documentation, string match…
Question
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The security engineer must implement a rule statement as part of the web ACL to block the requests. The rule statement must mitigate the current attack and future attacks from these IoT devices without blocking requests from customers. Which rule statement will meet these requirements?
Options
- AUse an IP set match rule statement that includes the IP address for IoT devices from the user
- BUse a geographic match rule statement. Configure the statement to block countries that the IoT
- CUse a rate-based rule statement. Set a rate limit that is equal to the number of requests that are
- DUse a string match rule statement that includes details of the IoT device brand from the user
How the community answered
(29 responses)- A10% (3)
- B14% (4)
- C3% (1)
- D72% (21)
Explanation
AWS WAF allows security engineers to create string match rule statements that inspect specific parts of web requests, including HTTP headers such as the User-Agent header. According to the AWS Certified Security - Specialty Study Guide and AWS WAF documentation, string match rules are ideal for blocking requests that contain known malicious identifiers, such as a distinctive user agent associated with a specific bot or IoT device brand. In this scenario, the attack originates from a specific IoT device brand that uses a unique user agent. A string match rule that inspects the User-Agent header can precisely block malicious requests while allowing legitimate customer traffic to continue uninterrupted. This approach provides targeted mitigation for both current and future attacks originating from the same device
Topics
Community Discussion
No community discussion yet for this question.