AWS WAF for web application firewall - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does AWS WAF handle requests that match a rule with an action set to COUNT?

In AWS WAF, you can set rules with different actions. What happens when a web request matches a rule whose action is set to COUNT?

A The request is blocked and counted in metrics.

B The request is blocked without being counted.

C The request is allowed without being counted.

D The request is allowed and counted in metrics.

💡 Hint

Think about what the COUNT action means: it lets the request pass but tracks it.

When a request matches a rule with action COUNT, AWS WAF allows the request to pass through but increments the count metrics for monitoring.

❓ Architecture

intermediate

Where should you place AWS WAF to protect a web application hosted on Amazon CloudFront?

You have a web application served through Amazon CloudFront. To protect it using AWS WAF, where should you associate the WAF web ACL?

A Associate the web ACL directly with the CloudFront distribution.

B Associate the web ACL with the origin S3 bucket.

C Associate the web ACL with the EC2 instances behind the CloudFront.

D Associate the web ACL with the Route 53 hosted zone.

💡 Hint

Think about where CloudFront processes requests before sending them to origins.

AWS WAF web ACLs can be associated directly with CloudFront distributions to inspect and filter incoming requests before they reach the origin.

❓ security

advanced

What is the effect of enabling AWS WAF rate-based rules on a web application?

You configure a rate-based rule in AWS WAF to block IP addresses that send more than 1000 requests in 5 minutes. What is the expected behavior when an IP exceeds this limit?

A The IP address receives a CAPTCHA challenge to verify it is human.

B The IP address is permanently blocked from accessing the application.

C The IP address is blocked temporarily until the request rate drops below the limit.

D The IP address is allowed but logged for review.

💡 Hint

Consider how rate limiting works to protect against sudden traffic spikes.

Rate-based rules block IP addresses temporarily when they exceed the configured request rate. The block is lifted when the rate drops below the threshold.

✅ Best Practice

advanced

Which AWS WAF configuration helps prevent SQL injection attacks effectively?

To protect your web application from SQL injection attacks, which AWS WAF feature should you enable or configure?

A Create a rate-based rule to block IPs sending many requests.

B Enable AWS Managed Rules for SQLi and configure a rule to block matching requests.

C Use AWS WAF to block all POST requests to the application.

D Disable all custom rules and rely on CloudFront caching.

💡 Hint

Think about specialized rules designed to detect common attack patterns.

AWS Managed Rules include pre-configured protections against SQL injection (SQLi). Enabling these rules helps detect and block SQLi attempts effectively.

🧠 Conceptual

expert

What is the primary difference between AWS WAF Classic and the latest AWS WAF in terms of rule management?

Consider AWS WAF Classic and the latest AWS WAF service. What is the main difference in how they manage rules and web ACLs?

A The latest AWS WAF supports rule groups and managed rule sets with reusable components; Classic does not.

B AWS WAF Classic supports managed rule groups; the latest AWS WAF requires manual rule creation only.

C The latest AWS WAF does not support associating web ACLs with CloudFront distributions.

D AWS WAF Classic allows only one rule per web ACL; the latest supports multiple rules.

💡 Hint

Think about improvements in modularity and reusability in newer AWS WAF versions.

The latest AWS WAF supports reusable rule groups and managed rule sets, allowing easier and modular rule management. AWS WAF Classic lacks these features.