Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 67 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 67
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet.

A security engineer needs to deny access from the offending IP addresses.

Which solution will meet these requirements?

A. Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.
B. Add a rule to all security groups to deny the incoming requests from the IP address range.
C. Modify the AWS WAF web ACL with a rate-based rule statement to deny the incoming requests from the IP address range.
D. Configure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the incoming requests based on the match condition.

Show Suggested Answer

Suggested Answer: A 🗳️

by oioi at Nov. 23, 2023, 8:15 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

IPLogic

4 days, 16 hours ago

Selected Answer: A

The best solution to deny access from the offending IP addresses is Option A: Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.

upvoted 1 times

...

navid1365

6 months, 3 weeks ago

Selected Answer: A

Different available categories for AWS WAF conditions: - ip address - geolocation -string and RegEx matching -SQLi -XSS -Size Constraints In this example ip address range is correct

upvoted 1 times

...

Raphaello

9 months, 2 weeks ago

Selected Answer: A

The offending IP's are specified, and the request is to "DENY" access from them. There's no reason to rate-limit the flow. Just block it. A.

upvoted 1 times

...

MikeRach

9 months, 4 weeks ago

AWS WAF--> Inspects the request against a set of IP addresses and address ranges. https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html

upvoted 1 times

...

3633f8f

11 months, 3 weeks ago

Selected Answer: A

As per below discussion.

upvoted 1 times

...

Daniel76

12 months ago

Selected Answer: C

https://docs.aws.amazon.com/waf/latest/developerguide/listing-managed-ips.html

upvoted 1 times

WeepingMaplte

11 months, 3 weeks ago

You will use rate limit if it is normal HTTP/s traffic. For port scanning is a network reconnaissance technique used to identify which ports on a computer system are open and potentially vulnerable. You will want to block it 100%.

upvoted 2 times

3633f8f

11 months, 3 weeks ago

The question is how to apply what the security engineer wants to do which is to block every single request coming from that IP set. Hence, I also think correct answer is A.

upvoted 2 times

...