A new utility account login page sees bursts of credential-stuffing attempts from many IPs. Which application-layer control best blunts that pattern without redesigning the whole identity stack overnight?
Select an answer to reveal the explanation.
Short Explanation
Credential stuffing is a firehose of guessed passwords. A WAF rate-based rule is the valve that slows the spray while you keep real customers moving.
Full Explanation
AWS WAF rate-based rules are a standard application-layer mitigation for credential stuffing and similar abusive request floods against login endpoints. Removing authentication, FTP publishing, or security-by-obscurity URLs do not constitute sound attack mitigation for a utility account login.