An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container…

The problem describes a brute-force login attack characterized by a high volume of requests ("spike") from a large, rotating set of IP addresses. The most operationally efficient solution is an automated one that does not require manual intervention. An AWS WAF rate-based rule automatically mitigates such attacks by tracking the rate of requests from individual source IP addresses. When an IP exceeds a configured threshold within a 5-minute period, WAF automatically blocks it. This directly addresses the "spike" from numerous IPs without needing to know the specific addresses in advance, making it the most efficient solution.

A. Using a security group to deny specific IPs is operationally inefficient because the list of 500 source IPs changes weekly, requiring constant manual identification and updates.
C. Allowing access only from specific CIDR ranges is not a viable solution for a global application, as it would block legitimate students from unlisted locations.
D. An AWS WAF IP set match rule requires a manually defined list of IP addresses. This is not operationally efficient as the malicious IPs change weekly, necessitating frequent manual updates.

1. AWS WAF Developer Guide, "Rate-based rule statement": This document states, "A rate-based rule tracks the rate of requests for each originating IP address... If an IP address breaches the limit, the rule action is applied to that IP address." This directly supports the automated, efficient nature of the solution in option B for handling brute-force attempts.

2. AWS WAF Developer Guide, "How AWS WAF works": This guide explains that you can "associate a web ACL with one or more AWS resources," including an Application Load Balancer. This confirms the integration described in the question.

3. AWS WAF Developer Guide, "IP set match rule statement": This document describes IP set match rules as checking "if the IP address of a web request is in a set of IP addresses and address ranges that you specify." This highlights the manual configuration required, making option D less efficient than option B.

4. Amazon VPC User Guide, "Security groups for your VPC": This guide details that security groups act as a firewall for associated instances, controlling inbound and outbound traffic at the instance level. While powerful, they are less suited for application-layer threats and less efficient for managing large, dynamic IP blocklists compared to AWS WAF.