Q57 — AWS SAA-C03 Ch.16

Question 57 of 100 | ← Chapter 16

Q1257. A company uses AWS WAF to protect its web applications. A solutions architect configures a web ACL that uses several rules, including a rule that inspects the HTTP request body for malicious content.The solutions architect notices that the web ACL is not inspecting large HTTP POST requests properly. As a result, suspicious activities are not being detected.Some large HTTP POST requests are more than 8 MB in size.The solutions architect must ensure that the web ACL inspects the large HTTP POST requests properly.Which solution will meet this requirement?

• A. Create two custom AWS WAF rules. Configure one rule to block all oversized requests. Configure the second rule with a higher priority to allow large requests from legitimate hosts.
• B. Enable AWS Shield Advanced. Reconfigure the web ACL to block oversized requests by using Shield Advanced.
• C. Verify that the Content-Type header is correctly set in the HTTP requests that AWS WAF rules inspect.
• D. Create an AWS Lambda function to preprocess the large requests before AWS rules inspect the requests ✓

Correct Answer: D. Create an AWS Lambda function to preprocess the large requests before AWS rules inspect the requests

Explanation

The correct answer is D. Create an AWS Lambda function to preprocess the large requests before AWS WAF rules inspect the requests.Explanation:AWS WAF has a default limit of 8 KB for inspecting HTTP request bodies (not 8 MB as mistakenly implied in some contexts; however, the core issue is that WAF cannot natively inspect very large POST requests). To properly inspect large HTTP POST requests (e.g., >8 MB), a preprocessing step is needed to extract relevant parts of the request for WAF inspection.Why Option D is Correct:AWS Lambda can preprocess large requests by:Extracting malicious content (e.g., SQLi, XSS) from large payloads. Passing only the relevant parts (or a hashed/sampled version) to AWS WAF for inspection. Blocking or logging malicious requests before they reach the application. No WAF rule changes are needed--Lambda acts as a middleware. Scales automatically (Lambda handles variable request sizes).Maintains security while avoiding WAF's size limitations.Why the Other Options Are Incorrect:A. Create two custom WAF rules (block oversized + allow legitimate large requests) WAF cannot inspect large requests beyond its limits--blocking oversized requests alone doesn't solve the detection problem.Allowing large requests bypasses inspection, leaving the application vulnerable. B. Enable AWS Shield Advanced & reconfigure WAF to block oversized requests AWS Shield Advanced provides DDoS protection, not enhanced WAF inspection for large payloads.Does not address WAF's body inspection limits.C. Verify Content-Type header is correctly setIrrelevant to the issue--WAF's inability to inspect large bodies persists regardless of headers.Alternative Consideration (If Lambda Isn't Preferred):If Lambda preprocessing is undesirable, another approach could be:Use Amazon API Gateway + Lambda Authorizer to inspect and filter requests before they reach WAF. However, Option D is the most straightforward AWS-native solution for this scenario.Conclusion:Option D is the best choice because:AWS Lambda can preprocess large requests to extract malicious content for WAF inspection.No WAF rule modifications or Shield Advanced are needed.Ensures proper detection of suspicious activities in large POST requests.Final Answer:D