A security engineer needs to configure DDoS protection for a Network Load Balancer (NLB) with an Elastic IP address. The security engineer wants to set up an AWS WAF web ACL with a rate- based rule…

Question

Options

• AConfigure the rule to use the Count action.
• BConfigure the rule to use the Block action.
• CConfigure the rule to use the Monitor action.
• DConfigure the rule to use the Allow action.

• A
  79% (23)
• B
  10% (3)
• C
  7% (2)
• D
  3% (1)

Explanation

AWS WAF rate-based rules are designed to help protect applications and resources from traffic floods and application-layer DDoS attacks by tracking the number of requests from individual source IP addresses over a rolling time window. According to the AWS Certified Security - Specialty Official Study Guide and AWS WAF documentation, rate-based rules can be configured with different actions, including Count, Block, and Allow. When a security engineer is determining an appropriate rate limit that will not block legitimate traffic, AWS best practices recommend initially configuring the rate-based rule with the Count action. The Count action allows AWS WAF to monitor and log requests that exceed the specified rate threshold without actively blocking them. This provides visibility into traffic patterns and enables the security engineer to analyze how the rule would behave in production. By using the Count action, the security engineer can safely evaluate whether legitimate users would be affected by the chosen rate limit. Once the engineer is confident that the threshold accurately distinguishes between normal traffic and malicious behavior, the action can later be changed to Block.

No community discussion yet for this question.