AWS WAF for web application firewall - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a Web ACL with AWS WAF.

AWS

aws wafv2 create-web-acl --name MyWebACL --scope REGIONAL --default-action Block={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=[1]

Drag options to blanks, or click blank then click option'

AWebACLMetric

BMetricName

CMyMetric

DDefaultMetric

Attempts:

3 left

💡 Hint

Common Mistakes

Using reserved words like 'MetricName' as the metric name.

Leaving the metric name empty.

Using spaces in the metric name.

The MetricName must be a unique name for CloudWatch metrics. 'WebACLMetric' is a valid example.

2fill in blank

medium

Complete the code to add a rule to allow requests from a specific IP set.

AWS

aws wafv2 update-web-acl --name MyWebACL --scope REGIONAL --rules '[{"Name": "AllowIPSetRule", "Priority": 1, "Action": {"Allow": {}}, "Statement": {"IPSetReferenceStatement": {"ARN": "[1]"}}, "VisibilityConfig": {"SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "AllowIPSetMetric"}}]'

Drag options to blanks, or click blank then click option'

Aarn:aws:ec2:region:account-id:instance/instance-id

Barn:aws:s3:::mybucket

Carn:aws:wafv2:region:account-id:ipset/ipset-id

Darn:aws:iam::account-id:user/username

Attempts:

3 left

💡 Hint

Common Mistakes

Using ARNs from unrelated AWS services.

Using incomplete or incorrect ARN formats.

The IPSetReferenceStatement requires the ARN of an AWS WAF IP set. Only option C is a valid IP set ARN.

3fill in blank

hard

Fix the error in the JSON rule statement to block SQL injection attacks.

AWS

"Statement": {"[1]": {"FieldToMatch": {"QueryString": {}}, "TextTransformations": [{"Priority": 0, "Type": "URL_DECODE"}]}}

Drag options to blanks, or click blank then click option'

ASqliMatch

BSqlInjectionMatchStatement

CSQLiMatchStatement

DSqliMatchStatement

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect casing or misspelled statement names.

Omitting 'Statement' suffix.

The correct AWS WAF statement key for SQL injection match is 'SqliMatchStatement'. It is case sensitive and must be exact.

4fill in blank

hard

Fill both blanks to create a rate-based rule that blocks requests over 1000 per 5 minutes.

AWS

"Rules": [{"Name": "RateLimitRule", "Priority": 1, "Action": {"Block": {}}, "Statement": {"[1]": {"Limit": [2], "AggregateKeyType": "IP"}}, "VisibilityConfig": {"SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "RateLimitMetric"}}]

Drag options to blanks, or click blank then click option'

ARateBasedStatement

BRateLimitStatement

C1000

D500

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect statement keys.

Setting the limit too low or too high without understanding.

The statement key for rate limiting is 'RateBasedStatement'. The limit value is the number of requests allowed, here 1000.

5fill in blank

hard

Fill all three blanks to define a managed rule group statement with AWS Managed Rules for common exploits.

AWS

"Statement": {"ManagedRuleGroupStatement": {"VendorName": "[1]", "Name": "[2]", "ExcludedRules": [{"Name": "[3]"}]}}

Drag options to blanks, or click blank then click option'

AAWS

BAWSManagedRulesCommonRuleSet

CSizeRestrictions_BODY

DMicrosoft

EAWSManagedRulesSQLiRuleSet

FNoUserAgentHeader

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong vendor names like 'Microsoft'.

Choosing wrong managed rule group names.

Excluding rules not in the group.

The vendor for AWS managed rules is 'AWS'. The common rule set is 'AWSManagedRulesCommonRuleSet'. 'SizeRestrictions_BODY' is a common rule to exclude.