SCS-C03 practice question: Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls)
Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A mobile game studio runs its login API behind Amazon CloudFront and AWS WAF. Attackers are trying to guess player passwords with many login requests. Many legitimate players use the same mobile carrier, so many of them share one public IP address.
The studio must limit login attempts per device without blocking players who share an address. Every app build sends a stable device identifier in a request header, and the limit must apply only to the login path.
Which WAF configuration meets these requirements?
Choose one answer.
AA. Create a rate-based rule keyed on the client IP address with a limit of 100 requests in five minutes, and block any address that goes over the limit.
BB. Create a regular rule that blocks every request to the login path from countries outside the studio's home region, and let the rest of the traffic through unchanged.
CC. Create a rate-based rule keyed on the client IP address with the action set to count, and review the counted requests in the WAF logs each morning.
DD. Create a rate-based rule with a custom aggregation key on the device ID header, scoped down to the login path, that blocks a device over the limit.
Show the answer and explanation
Answer: D
A. Wrong: Players on the same carrier share one address, so the shared address hits the limit and is blocked along with the attackers. The rule also ignores the device identifier, which the requirement says to use.
B. Wrong: Geographic blocking is not a per-device limit, and attackers can route through proxies in the home region. It would also block legitimate players who travel.
C. Wrong: A count action records the requests but does not stop them, so the attack keeps running. A morning review also leaves the attackers many hours to guess passwords.
D. Right: Correct. A custom key on the header counts requests per device, so a shared carrier address is not blocked by mistake. The scope-down statement applies the limit only to the login path, as the requirement asks. Learn more: Rate-based rule statement (opens in a new tab)
Explanation
A rate-based rule with a custom header key limits each device rather than each shared address, and a scope-down statement limits it to the login path. IP keys block shared carrier addresses, geographic rules do not limit devices, and count actions do not stop attacks.
Want more on Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls)? The 5 full-length practice sets have 5 more Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →