A public-facing assistant built on Amazon Bedrock is suddenly receiving thousands of crafted requests from a handful of client IP ranges, apparently trying prompt injection at scale. Which combination gives the fastest automated mitigation and alerting?
Show answer and explanation
Answer: D
Automated defense works at two layers. AWS WAF rate-based rules throttle or block high-volume sources, and its managed rule groups filter known bad IP reputation and anonymous traffic. CloudWatch anomaly detection flags unusual invocation or error patterns so the team learns about the campaign quickly. Weekly reviews leave the surge running for days, outright shutdown harms genuine customers, and a smaller model does not stop crafted requests.
Why the other options are wrong
- A. A weekly manual review leaves the surge running for days, long after the attacker has consumed capacity and inflated cost.
- B. Disabling the endpoint is a blunt outage that also blocks genuine customers, and it does not reveal who is attacking.
- C. A smaller model does not stop crafted requests. Injection and abuse are handled at the request layer, not by reducing model size.