ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Study guide / Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls)

Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls): SCS-C03 study notes and practice questions

What to know about Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls) for the SCS-C03 exam, from the Infrastructure Security domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

Questions in this topic describe a web application under attack or at risk, such as scrapers, credential stuffing, a flood of requests from one client, or a new class of exploit. You pick the WAF capability that blocks the traffic at the right layer with the least rule maintenance.

What WAF inspects and where it attaches

  • A web ACL holds rules and a default action. Attach it to Amazon CloudFront distributions, Application Load Balancers, Amazon API Gateway REST APIs, AWS AppSync APIs and Amazon Cognito user pools.
  • WAF reads HTTP and HTTPS request content: headers, URI path, query strings, body and source IP. It does not inspect non-HTTP traffic, and it does not attach to a Network Load Balancer.
  • A web ACL for CloudFront uses the global scope and is created in us-east-1. A web ACL for a regional resource is created in the Region of that resource.
  • AWS Managed Rules rule groups cover common threats such as known bad inputs and SQL injection. Start with them before writing custom signatures.
  • Rate-based rules count requests from each IP address over a rolling window. Behind a CDN or proxy, count the forwarded client IP address instead, or every user shares one counter. A scope-down statement limits the count to one path, such as a login endpoint.
  • AWS WAF Bot Control identifies scrapers and bots at a common or targeted level. Fraud control adds account takeover prevention (ATP) for login attacks and account creation fraud prevention (ACFP) for signup abuse.
  • A rule that matches a JA3 or JA4 fingerprint identifies the TLS client signature, which helps against bots that rotate IP addresses.
  • Use Count mode to test a new rule against live traffic before you block. Logs go to Amazon S3, CloudWatch Logs or Amazon Data Firehose.

Read the AWS WAF developer guide and the AWS Managed Rules rule group list before the exam.

How to choose

Scenario wording Pick
Block SQL injection and known bad inputs with no custom rules AWS Managed Rules groups in a web ACL
Limit one client’s request rate on a login endpoint Rate-based rule with a scope-down statement
Stop scrapers that rotate IP addresses Bot Control, or a JA3 or JA4 fingerprint match
Detect credential stuffing on a login page Fraud control account takeover prevention
Protect a Network Load Balancer or a non-HTTP port Security groups, network ACLs or Network Firewall, not WAF
Allow only known countries, IP ranges or ASNs Geo match, IP set or ASN match conditions

Common traps

  • Security groups for application attacks. A security group can allow or block a port or CIDR range. It cannot read a request path or a header.
  • Shield Standard alone for request floods. Shield handles network and transport layer attacks. HTTP floods need WAF rate limits.
  • Rate limits keyed on the CDN’s address. Count the forwarded client IP, or all users share one bucket.
  • Blocking before testing. Start in Count mode, read the logs, then switch to Block.
  • Writing custom rules for threats that an AWS Managed Rules group already covers.

Try the 1 practice question

Practice Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls)Take the free practice exam

Question 1

Medium ·Link to this question (question 1)

A mobile game studio runs its login API behind Amazon CloudFront and AWS WAF. Attackers are trying to guess player passwords with many login requests. Many legitimate players use the same mobile carrier, so many of them share one public IP address.

The studio must limit login attempts per device without blocking players who share an address. Every app build sends a stable device identifier in a request header, and the limit must apply only to the login path.

Which WAF configuration meets these requirements?

Choose one answer.

  1. A. Create a rate-based rule keyed on the client IP address with a limit of 100 requests in five minutes, and block any address that goes over the limit.
  2. B. Create a regular rule that blocks every request to the login path from countries outside the studio's home region, and let the rest of the traffic through unchanged.
  3. C. Create a rate-based rule keyed on the client IP address with the action set to count, and review the counted requests in the WAF logs each morning.
  4. D. Create a rate-based rule with a custom aggregation key on the device ID header, scoped down to the login path, that blocks a device over the limit.
Show the answer and explanation

Answer: D

  • A. Wrong: Players on the same carrier share one address, so the shared address hits the limit and is blocked along with the attackers. The rule also ignores the device identifier, which the requirement says to use.
  • B. Wrong: Geographic blocking is not a per-device limit, and attackers can route through proxies in the home region. It would also block legitimate players who travel.
  • C. Wrong: A count action records the requests but does not stop them, so the attack keeps running. A morning review also leaves the attackers many hours to guess passwords.
  • D. Right: Correct. A custom key on the header counts requests per device, so a shared carrier address is not blocked by mistake. The scope-down statement applies the limit only to the login path, as the requirement asks. Learn more: Rate-based rule statement (opens in a new tab)

Explanation

A rate-based rule with a custom header key limits each device rather than each shared address, and a scope-down statement limits it to the login path. IP keys block shared carrier addresses, geographic rules do not limit devices, and count actions do not stop attacks.

Study

Want more on Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls)? The 5 full-length practice sets have 5 more Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls)

More Infrastructure Security topics