Question

A retail company runs a public storefront behind a global external Application Load Balancer with a Cloud Armor security policy attached to the backend service. During a flash sale, the site experiences a sudden surge of HTTP requests that appear to originate from thousands of distinct IP addresses with subtly varied request patterns, overwhelming the backends. The security team cannot manually author rate-limit or IP-deny rules fast enough to keep pace with the shifting attack signatures. Which Cloud Armor capability should they enable to automatically detect and generate a suggested mitigation rule for this Layer 7 volumetric attack?

Accepted Answer

Enable Adaptive Protection on the Cloud Armor security policy so it baselines normal traffic and auto-generates a suggested rule to mitigate the anomalous Layer 7 attack.

Answer

Configure a preconfigured WAF rule using the OWASP ModSecurity Core Rule Set (CRS) to block the SQL injection signatures in the requests.

Answer

Attach a rate-limiting throttle rule keyed on a single named IP address list containing the known attacker ranges.

Answer

Enable edge security policies with a country-based geo-match deny rule to block the source region generating the traffic.