A hugely popular video-sharing application is deployed on multiple EC2 instances in different AZs. Amazon CloudFront is configured to provide minimum latency to global users accessing this web application. Due to recent geopolitical tension, Security Team needs to provide the least preference for users accessing web applications from a list of countries sanctioned by law enforcement bodies. There should not be any impact for users in other countries accessing this application. Which of the following can be configured to meet this requirement with the least effort?

Answer options:

A.Use AWS WAF Geographic Match & rate limiting match rules with Amazon CloudFront to provide the least preference to users from this list of countries while accessing the application.
B.Use AWS WAF Geographic Match & IP Address match rules with Amazon CloudFront to provide the least preference to users from this list of countries while accessing the application.
C.Use AWS WAF IP address& rate limiting match rules with Amazon CloudFront to provide the least preference to users from this list of countries while accessing the application.
D.Use AWS WAF IP address & string match rules with Amazon CloudFront to provide the least preference to users from this list of countries while accessing the application.

Correct Answer – A
AWS WAF can be used with Amazon CloudFront to protect web applications from common attacks. With AWS WAF, the following conditions can be used to deny traffic to web applications,
· Cross-Site Scripting
· IP Address
· Length of request
· SQL injection
· Geographic Match
· String Match.
Also, AWS WAF provides rate limiting rules which consider the number of requests for match condition in 5 min interval.
In the above case, since the customer wants to provide the least preference for users from the list of countries, the Geographical match rule along with the Rate limiting rule can be implemented on AWS WAF.Option B is incorrect as using an IP address with AWS WAF will deny all user requests from a geographic location.
Option C is incorrect as Using an IP address will accurately block a request from a geographic location.
Option D is incorrect as string match will not be able to provide preference to users based upon geographic location.
For more information on using AWS WAF with Amazon CloudFront, refer to the following URLs
https://aws.amazon.com/blogs/security/how-to-use-aws-waf-to-filter-incoming-traffic-from-embargoed-countries/
https://aws.amazon.com/about-aws/whats-new/2017/10/aws-waf-now-supports-geographic-match/