SCS-C02 Exam Dumps : AWS Certified Security - Specialty

Create an AWS WAF Web ACL:

Use AWS WAF to create a web ACL for the CloudFront distribution.

Add Managed Rules for Bot Protection:

Include theAWSManagedRulesACFPRuleSetto protect against automated bots and account fraud.

Add a Rate-Based Rule:

Implement a rate limit rule to restrict the number of requests to/store/registrationduring promotions.

Example rule: Deny requests exceeding 100 per minute.

Associate the Web ACL with CloudFront:

Attach the web ACL to the CloudFront distribution to enforce the rules globally at edge locations.

Advantages:

Prevents Fraudulent Activity: Detects and mitigates bot activity.

Scalable: Operates at the CloudFront level, ensuring global protection.

AWS WAF Managed Rules

Rate-Based Rules in WAF

The correct answer is A because it allows the security engineer to add the X-Frame-Options header to the HTTPS responses from the application origin without modifying the origin itself. A Lambda@Edge function is a Lambda function that runs in response to CloudFront events, such as viewer request, origin request, origin response, or viewer response. By configuring the function to runin response to the origin response event, the security engineer can modify the response headers that CloudFront receives from the origin before sending them to the viewer1. The function can include code to add the X-Frame-Options header with the desired value, suchas DENY or SAMEORIGIN, to prevent frame-related cross-site scripting attacks2.

The other options are incorrect because they are either less efficient or less secure than option A. Option B is incorrect because configuring the Lambda@Edge function to run in response to the viewer request event is not optimal, as it adds latency to the request processing and does not modify the response headers that CloudFront receives from the origin. Option C is incorrect because adding X-Frame-Options to custom headers in the origin settings does not affect the response headers that CloudFront sends to the viewer. Custom headers are only used to send additional information to the origin when CloudFront forwards a request3. Option D is incorrect because customizing the EC2 hosted application to add the X-Frame-Options header to the responses requires changing the origin code, which may not be feasible or desirable for the security engineer.