A global media site behind CloudFront and WAF faces credential stuffing from rotating IPs in two sanctioned countries, plus bots that rotate user agents but share TLS fingerprints. Which edge rule set should the engineer deploy to block geography and fingerprint bots while limiting login abuse?
Select an answer to reveal the explanation.
Short Explanation
You've got bots wearing new masks every time, so you'll want to check their location, their speed, and their handshake all at once. It's like spotting regulars at your café by their order, not their coat, and that's where JA3 fingerprinting does the heavy lifting.
Full Explanation
The correct rule set maps three distinct edge controls to three distinct signals: a geo-match statement enforces the sanctioned-country block by origin regardless of IP rotation, a scope-down rate-based rule on the login URI throttles high-velocity credential stuffing without penalizing global media browsing, and a CAPTCHA challenge combined with JA3 inspection identifies bots that rotate User-Agent strings but cannot easily change their TLS client handshake. A managed IP reputation blocklist fails the geography concept because reputation evaluates known threat intelligence rather than sovereign origin and is evaded by fresh rotating addresses, so sanctioned traffic would still pass despite good login and fingerprint coverage. An aggregate rate-based rule across all paths equally fails the scoping concept because legitimate article and video traffic dilutes the login request count and delays enforcement, allowing targeted login abuse to remain under threshold while risking false positives elsewhere. Common-level Bot Control without JA3 inspection fails the fingerprint concept because it mainly recognizes self-identifying bots from user-agent and header signals, which rotate here, whereas JA3 provides a stable TLS-level identifier for that bot family. For the exam, remember CloudFront geographic restriction and WAF geo-match are not interchangeable, and JA3 matching requires inspecting the TLS fingerprint field rather than header strings. In practice, validate with WAF sampled requests and CloudWatch metrics for the geo, rate-based, and CAPTCHA rules in Count mode before enforcing Block to avoid false positives from shared corporate NAT and common legitimate TLS stacks.