AWS WAF for web application firewall - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does AWS WAF handle requests that match a rule with an action set to COUNT?

In AWS WAF, you can set rules with different actions. What happens when a web request matches a rule whose action is set to COUNT?

A The request is blocked and counted in metrics.

B The request is blocked without being counted.

C The request is allowed without being counted.

D The request is allowed and counted in metrics.

💡 Hint

Think about what the COUNT action means: it lets the request pass but tracks it.

When a request matches a rule with action COUNT, AWS WAF allows the request to pass through but increments the count metrics for monitoring.

❓ Architecture

intermediate

Where should you place AWS WAF to protect a web application hosted on Amazon CloudFront?

You have a web application served through Amazon CloudFront. To protect it using AWS WAF, where should you associate the WAF web ACL?

A Associate the web ACL directly with the CloudFront distribution.

B Associate the web ACL with the origin S3 bucket.

C Associate the web ACL with the EC2 instances behind the CloudFront.

D Associate the web ACL with the Route 53 hosted zone.

💡 Hint

Think about where CloudFront processes requests before sending them to origins.

AWS WAF web ACLs can be associated directly with CloudFront distributions to inspect and filter incoming requests before they reach the origin.

❓ security

advanced

What is the effect of enabling AWS WAF rate-based rules on a web application?

You configure a rate-based rule in AWS WAF to block IP addresses that send more than 1000 requests in 5 minutes. What is the expected behavior when an IP exceeds this limit?

A The IP address receives a CAPTCHA challenge to verify it is human.

B The IP address is permanently blocked from accessing the application.

C The IP address is blocked temporarily until the request rate drops below the limit.

D The IP address is allowed but logged for review.

💡 Hint

Consider how rate limiting works to protect against sudden traffic spikes.

Rate-based rules block IP addresses temporarily when they exceed the configured request rate. The block is lifted when the rate drops below the threshold.

✅ Best Practice

advanced

Which AWS WAF configuration helps prevent SQL injection attacks effectively?

To protect your web application from SQL injection attacks, which AWS WAF feature should you enable or configure?

A Create a rate-based rule to block IPs sending many requests.

B Enable AWS Managed Rules for SQLi and configure a rule to block matching requests.

C Use AWS WAF to block all POST requests to the application.

D Disable all custom rules and rely on CloudFront caching.

💡 Hint

Think about specialized rules designed to detect common attack patterns.

AWS Managed Rules include pre-configured protections against SQL injection (SQLi). Enabling these rules helps detect and block SQLi attempts effectively.

🧠 Conceptual

expert

What is the primary difference between AWS WAF Classic and the latest AWS WAF in terms of rule management?

Consider AWS WAF Classic and the latest AWS WAF service. What is the main difference in how they manage rules and web ACLs?

A The latest AWS WAF supports rule groups and managed rule sets with reusable components; Classic does not.

B AWS WAF Classic supports managed rule groups; the latest AWS WAF requires manual rule creation only.

C The latest AWS WAF does not support associating web ACLs with CloudFront distributions.

D AWS WAF Classic allows only one rule per web ACL; the latest supports multiple rules.

💡 Hint

Think about improvements in modularity and reusability in newer AWS WAF versions.

The latest AWS WAF supports reusable rule groups and managed rule sets, allowing easier and modular rule management. AWS WAF Classic lacks these features.

Practice

1. What is the main purpose of AWS WAF (Web Application Firewall)?

easy

A. To store large amounts of data securely

B. To manage virtual machines in the cloud

C. To protect web applications by filtering and blocking harmful web traffic

D. To monitor network bandwidth usage

Solution

1. Step 1: Understand AWS WAF's role

   AWS WAF is designed to protect web applications by filtering incoming HTTP requests based on rules.

2. Step 2: Compare options with AWS WAF function

   Only To protect web applications by filtering and blocking harmful web traffic describes filtering and blocking harmful web traffic, which matches AWS WAF's purpose.

3. Final Answer:

   To protect web applications by filtering and blocking harmful web traffic -> Option C

4. Quick Check:

   AWS WAF = Web traffic protection [OK]

Hint: AWS WAF filters web traffic to protect apps [OK]

Common Mistakes:

• Confusing AWS WAF with storage services
• Thinking AWS WAF manages virtual machines
• Assuming AWS WAF monitors bandwidth

2. Which of the following is the correct way to create a rule in AWS WAF to block requests from a specific IP address?

easy

A. Use AWS Shield to block the IP address

B. Directly add the IP address to the Web ACL without a rule

C. Create a Lambda function to block the IP address

D. Create an IP set with the IP address, then add a rule to block requests matching that IP set

Solution

1. Step 1: Understand AWS WAF rule creation

   In AWS WAF, you create an IP set containing IP addresses, then create a rule that uses this IP set to block matching requests.

2. Step 2: Evaluate options for correctness

   Create an IP set with the IP address, then add a rule to block requests matching that IP set correctly describes creating an IP set and a rule. Options B, C, and D do not follow AWS WAF's process.

3. Final Answer:

   Create an IP set with the IP address, then add a rule to block requests matching that IP set -> Option D

4. Quick Check:

   IP set + rule = block IP [OK]

Hint: Use IP sets with rules to block IPs in AWS WAF [OK]

Common Mistakes:

• Trying to block IPs directly in Web ACL without rules
• Confusing AWS WAF with Lambda or Shield
• Skipping IP set creation

3. Given this AWS WAF rule configuration snippet:
{"Name": "BlockBadBots", "Priority": 1, "Action": {"Block": {}}, "Statement": {"ByteMatchStatement": {"SearchString": "BadBot", "FieldToMatch": {"UriPath": {}}, "TextTransformations": [{"Priority": 0, "Type": "NONE"}]}}}
What will happen when a request URI contains the text "BadBot"?

medium

A. The rule will cause an error and not apply

B. The request will be blocked by AWS WAF

C. The request will be logged but allowed

D. The request will be allowed without filtering

Solution

1. Step 1: Analyze the ByteMatchStatement

   The rule looks for the string "BadBot" in the URI path and blocks the request if found.

2. Step 2: Understand the action on match

   The action is "Block", so any request matching the condition will be blocked.

3. Final Answer:

   The request will be blocked by AWS WAF -> Option B

4. Quick Check:

   Match "BadBot" in URI = block request [OK]

Hint: ByteMatch with Block action blocks matching requests [OK]

Common Mistakes:

• Assuming requests are allowed by default
• Confusing Block with Count or Allow actions
• Thinking the rule causes errors

4. You created an AWS WAF rule to block requests from IP 203.0.113.5, but requests from this IP are still allowed. What is the most likely cause?

medium

A. The Web ACL is not associated with the resource

B. AWS WAF does not support blocking IP addresses

C. The IP address was not added to the IP set used by the rule

D. The rule action is set to Allow instead of Block

Solution

1. Step 1: Check IP set and rule configuration

   If the IP was not added to the IP set or the rule action was wrong, blocking would fail, but these are common mistakes.

2. Step 2: Verify Web ACL association

   Even if rules are correct, if the Web ACL is not linked to the web resource (like CloudFront or ALB), rules won't apply.

3. Final Answer:

   The Web ACL is not associated with the resource -> Option A

4. Quick Check:

   Web ACL association needed for rules to apply [OK]

Hint: Always associate Web ACL with resource to enforce rules [OK]

Common Mistakes:

• Forgetting to associate Web ACL with the resource
• Assuming AWS WAF can't block IPs
• Setting wrong rule action

5. You want to protect your web app from SQL injection and block requests from a list of suspicious IPs. Which AWS WAF setup is best?

hard

A. Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs

B. Use only an IP set rule to block suspicious IPs, ignoring SQL injection

C. Create a Lambda function to inspect requests and block SQL injection

D. Enable AWS Shield Advanced to block SQL injection and IPs

Solution

1. Step 1: Identify protection needs

   You need to block SQL injection attacks and block suspicious IP addresses.

2. Step 2: Choose AWS WAF features

   AWS WAF provides managed rule groups for SQL injection and supports IP set rules for blocking IPs.

3. Step 3: Evaluate options

   Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs combines managed SQL injection rules and custom IP set blocking, which is best practice. Options B, C, and D do not fully meet requirements or use incorrect services.

4. Final Answer:

   Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs -> Option A

5. Quick Check:

   Managed rules + IP sets = full protection [OK]

Hint: Combine managed rules with IP sets for layered protection [OK]

Common Mistakes:

• Using only IP blocking without SQL injection rules
• Relying on Lambda or Shield for WAF tasks
• Not combining rules in one Web ACL