AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 301

Question

A company is running its application on AWS. Malicious users exploited a recent promotion event and created many fake accounts. The application currently uses Amazon CloudFront in front of an Amazon API Gateway API. AWS Lambda functions serve the different API endpoints. The GET registration endpoint is behind the path of /store/registration. The URI for submission of the new account details is at /store/newaccount. A security engineer needs to design a solution that prevents similar exploitations for future promotion events. Which combination of steps will meet these requirements? (Choose two.)

Accepted Answer

Correct answer: A, B. The correct answer is A, B. Option A: Create an AWS WAF web ACL. Add the AWSManagedRulesACFPRuleSet rule group to the web ACL. Associate the web ACL with the CloudFront distribution. Option B: Create an AWS WAF web ACL. Add a rate limit rule to the web ACL. Include a RateBasedStatement entry that has a SearchString value that points to /store/registration. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS WAF protects web applications from common exploits and malicious requests.

AWS Certified Security - Specialty SCS-C02 — Question 301