3.1 - Design edge network security controls (CloudFront, WAF, Shield, API Gateway)

1. Every internet facing load balancer of an organization must carry the same baseline web ACL, including the ones created tomorrow in accounts you do not operate. What do you deploy?

• AWS Config, with a conformance pack deployed to every account so that a load balancer lacking a web ACL is recorded as a non compliant resource in the aggregator
• AWS Control Tower, whose preventive guardrails create the web ACL
• AWS Firewall Manager, with a WAF policy scoped to the organization (correct answer)
• A CloudFormation StackSet executed once in every region

Firewall Manager applies a WAF, Shield or security group policy across the accounts of an organization and remediates automatically when a new in scope resource appears. Config only reports non compliance without attaching anything, Control Tower guardrails do not create web ACLs, and a StackSet runs once and ignores resources created later.

2. In AWS Network Firewall, in which order are the two rule engines applied to a packet?

• Stateless rules first, then stateful rules if the packet was forwarded (correct answer)
• Stateful rules first, because they carry the domain name and TLS logic that the stateless engine would otherwise have to recompute for every single packet of a flow
• Both engines run in parallel and the stricter verdict is the one applied
• Only one engine runs, selected by the priority given to the rule group

Network Firewall runs the stateless engine first, packet by packet, and only what it forwards reaches the stateful engine that tracks flows and matches domains. The order is fixed, the two engines are chained rather than parallel, and both always participate when the stateless verdict is forward.

3. Automated scrapers imitating real browsers are draining your catalogue pages, at a request rate low enough to stay under any threshold. Which AWS WAF feature identifies them?

• A rate based rule, which counts the requests of each source address over a sliding window and blocks the ones that go past the configured threshold
• A geographic match statement restricted to the countries where the catalogue is sold
• The oversize request body handling option of the web ACL
• The AWS WAF Bot Control managed rule group (correct answer)

Bot Control fingerprints clients and labels them by category, so a well behaved scraper is caught on its signature rather than on its volume. A rate based rule is useless against traffic that stays under the threshold, a geographic filter would also block legitimate buyers, and body size handling has nothing to do with automation.

4. Card numbers submitted through a form must remain unreadable by the intermediate application tiers and be decrypted only by one payment service. Which CloudFront feature delivers that?

• Origin access control, which makes CloudFront sign every request sent to the origin so that the payload can be verified before any application tier reads it
• Field level encryption, applied with a public key to named form fields (correct answer)
• A response headers policy that adds strict transport security to every reply
• Signed URLs generated for the checkout page and valid for a few minutes

Field level encryption encrypts the designated fields at the edge with a public key, so only the holder of the matching private key can read them further down the chain. Origin access control authenticates CloudFront to the origin without hiding anything from the application, response headers govern the browser, and signed URLs control access rather than payload confidentiality.

5. A CloudFront distribution serves objects from an S3 bucket. How do you make sure the bucket can only be read through CloudFront?

• Make the bucket public but rely on the distribution's alternate domain name so that nobody guesses the original S3 URL of an object
• Use origin access control and a bucket policy that allows only the distribution (correct answer)
• Enable requester pays on the bucket so that direct callers are billed and give up, while CloudFront keeps serving the cached objects
• Put the bucket in a private subnet of the VPC and route the distribution through an interface endpoint attached to that subnet

Origin access control lets CloudFront sign requests to the origin with SigV4, and a bucket policy conditioned on the distribution ARN refuses everything else. Obscuring the URL is not a control since S3 endpoints are predictable, requester pays changes billing rather than authorization, and an S3 bucket is not a VPC resource that can live in a subnet.

6. A public web application is hit by a flood of HTTP requests from a rotating set of source addresses. Which control throttles this at layer 7?

• An AWS WAF rate based rule on the distribution (correct answer)
• A network ACL that denies each offending address as soon as it appears in the VPC Flow Logs of the public subnet
• A security group inbound rule restricted to the corporate address ranges, applied to the load balancer of the public application
• An Amazon Route 53 health check that fails the record over to a static maintenance page hosted in a second region

A rate based rule counts requests per source over a sliding window and blocks the ones that cross the threshold, which is exactly the layer 7 flood case. Network ACLs are manual, capped in size and always late against rotating addresses, a corporate allow list would lock out the public users the site exists for, and failing over merely replaces the site with an error page.