312-50 Question 439
Single answer▪ Serverless ComputingA company exposes an AWS Lambda function through Amazon API Gateway to process image uploads. During a security assessment, a CEH discovers that anyone on the internet can invoke the endpoint repeatedly with large numbers of valid requests, causing excessive executions and increased cloud costs, even though the requests do not exploit a code flaw. The company wants the most effective control to reduce this serverless-specific abuse at the entry point without changing the Lambda business logic. What should the tester recommend?
- A
Configure throttling and request quotas in API Gateway, and optionally front the API with AWS WAF rate-based rules
- B
Increase the Lambda function timeout so long-running requests are less likely to fail under heavy traffic
- C
Move the Lambda function into a private subnet so internet users cannot trigger it through API Gateway
- D
Disable CloudWatch logging to reduce the overhead created by repeated invocations
Show answer and explanation
Correct answer: A
Explanation
This question tests practical security control selection for a serverless architecture. A common serverless risk is denial-of-wallet, where an attacker repeatedly triggers metered services such as API Gateway and Lambda using otherwise valid requests. Because the issue is uncontrolled invocation rather than code execution, the best mitigation is to enforce controls at the ingress layer. AWS best practices support using API Gateway throttling, quotas, authentication/authorization, and AWS WAF protections to reduce abuse of public endpoints. Lambda timeout settings and VPC placement do not solve public invocation abuse, and reducing logging harms visibility without addressing the root cause. Relevant guidance can be found in AWS documentation for Amazon API Gateway throttling and quotas, AWS WAF rate-based rules, and AWS Lambda security best practices.
- A. Correct.
Correct. In this scenario, the abuse occurs through repeated legitimate invocations of a public serverless endpoint. API Gateway throttling and usage quotas are designed to limit request rates and burst behavior at the front door, helping reduce denial-of-wallet and resource-consumption attacks. Adding AWS WAF rate-based rules can further block or slow abusive clients before they reach the API. This is the most appropriate control because it addresses the problem at the invocation layer without requiring changes to Lambda code.
- B. Incorrect.
Incorrect. Increasing the Lambda timeout does not reduce abusive invocation rates or control cost exposure. In fact, a longer timeout can increase cost if malicious or excessive requests cause functions to run longer. This option reflects a misunderstanding between reliability tuning and abuse prevention.
- C. Incorrect.
Incorrect. Placing Lambda in a private subnet does not make an API Gateway-triggered Lambda function private. API Gateway can still invoke Lambda through AWS-managed integration. VPC placement affects the function's network access to other resources, not whether the public API endpoint can be called by external users.
- D. Incorrect.
Incorrect. Disabling CloudWatch logging may slightly reduce observability costs, but it does not prevent repeated invocations or stop cost escalation from Lambda execution and API requests. It also weakens detection and incident response capability, which is contrary to security best practices.