SOA-C03 practice question: WAF, Shield and Network Firewall

Networking and Content Delivery A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A ski resort's lift-ticket store runs behind an Application Load Balancer protected by AWS WAF. On the morning season passes go on sale, scripted clients send thousands of requests per minute each from changing IP addresses, and real customers see timeouts. Normal customers send fewer than 100 requests in five minutes. The resort wants to automatically block any single IP address that sends far more requests than that. What should a CloudOps engineer add?

Choose one answer.

A. A network ACL on the load balancer's subnets with deny rules for the IP addresses seen in the access logs.
B. Deny rules in the load balancer's security group for each IP address that sends too many requests.
C. A rate-based rule in the web ACL that blocks any IP address whose request count over the evaluation window passes a set limit.
D. An AWS Shield Advanced subscription so that the AWS Shield Response Team blocks the scripted clients for the resort.

Show the answer and explanation

Answer: C

A. Wrong: Network ACLs have a limited number of rules and must be updated by hand. The scripted clients keep changing addresses, so a static list would not keep up. Learn more: Control subnet traffic with network access control lists (opens in a new tab)
B. Wrong: Security groups support only allow rules, so they cannot deny specific addresses. They also have no notion of request rates. Learn more: Control traffic to your AWS resources using security groups (opens in a new tab)
C. Right: Correct. A rate-based rule counts requests from each IP address over a time window and blocks addresses that exceed the limit. It adapts as new addresses appear and unblocks them when their rate drops. Learn more: Using rate-based rule statements in AWS WAF (opens in a new tab)
D. Wrong: Shield Advanced adds DDoS protection and response support, but at significant cost and with a one-year commitment. A WAF rate-based rule handles request floods from individual addresses directly. Learn more: AWS Shield Advanced overview (opens in a new tab)

Explanation

AWS WAF rate-based rules track the request rate of each client IP address and block addresses that go over a threshold, for as long as they stay over it. They work at the application layer in front of the load balancer and need no manual address lists. Security groups cannot deny, and network ACLs are static and limited in size.

SOA-C03 practice question: WAF, Shield and Network Firewall

Explanation

Study

Keep practicing