Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 274 discussion

B. - ATP checks email and password combinations against its stolen credential database, which is updated regularly as new leaked credentials are found on the dark web - ATP can temporarily block client sessions or IP addresses that have too many login failures - AWS WAF performs response inspection asynchronously, so this doesn't increase latency in your web traffic https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-atp.html

Answer A and B

B - This satisfy the requirement to reduce the chance of stuffing attack E - This satisfy the requirement to minimize impact on legitimate users, as they prevent legit users who may be part of a credential stuffing attack (due to their compromised credentials) from being permanently blocked A leverage Cloudwatch, which is only suitable for monitoring. It goes with D, but option D which block access from IP with multiple success logins will affect legit users more than bad actors. Similarly, setting default CAPTCHA in option C will create more friction to legit users more than mitigating the issue.

Explanation: By monitoring and analyzing successful login attempts from individual IP addresses, you can detect patterns that suggest credential stuffing. This allows you to take targeted actions against suspicious IPs, improving security without impacting legitimate users. B. Add the account takeover prevention (ATP) AWS managed rule group to the web ACL. Configure the rule group to inspect login requests to the system. Block any requests that have the awswaf:managed:aws:atp:signal:credential_compromised label. Explanation: This managed rule group specifically targets account takeover attempts, including credential stuffing. By automatically inspecting and blocking compromised login requests, you add a critical layer of defense without disrupting legitimate user access.

Option B: Adding the AWS managed rule group for account takeover prevention (ATP) is a highly effective approach. This rule group is specifically designed to detect and mitigate credential stuffing attacks. It can inspect login attempts, and when it detects a potential compromise based on exposed credentials (indicated by the label awswaf:managed:aws:atp:signal:credential_compromised), it blocks the request. This action directly addresses the security concern while minimizing the impact on legitimate users. Option A: By creating a custom CloudWatch metric to track successful login attempts from a single IP address, you can proactively monitor and detect patterns indicative of a credential stuffing attack (such as a high volume of successful logins from one source). This allows you to implement additional measures (e.g., blocking or rate-limiting) based on the analysis of this metric without affecting legitimate users.

I think b and d