For Teachers · Back to the Module · Print with your browser's Print command.

P25 Teacher Answer Key: Availability Without Load Testing

Teacher Answer Key (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F3

Learning Objectives

• [ ] Explain the difference between performance testing and a configuration review.
• [ ] Name the settings that limit request rate, size and duration.
• [ ] Know when real load testing is appropriate and who must approve it.

Key Terms

Write each definition in your own words.

• Rate Limiting: Capping how many requests one client may send in a period, so a flood or a password guessing run slows down.
• Slowloris: An attack that opens many requests and sends them very slowly, keeping every web server worker busy.
• Intrusion Prevention: Automatically blocking a source after repeated suspicious behaviour, for example failed logins seen in the log.
• Brute Force: Trying many passwords or keys in turn until one works.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo vulnerable --only WEB-APA-011,WEB-NGX-006 --out p25 and list the missing limits.
2. Write the nginx lines that add a login rate limit of 10 requests per minute per address.

Self-Check Questions

1. Why does OpenVAPT not send heavy traffic to test availability?

• [ ] a) It is too slow
• [x] b) Heavy traffic can take a service down and, without permission, is an attack
• [ ] c) Servers block it anyway
• [ ] d) It needs a paid licence
• Answer: b. Floods can break the system being assessed. A configuration review avoids that risk.

1. What does a slow request attack (Slowloris) exploit?

• [ ] a) Weak passwords
• [x] b) Workers kept busy by clients that send requests very slowly
• [ ] c) Old TLS versions
• [ ] d) Large images
• Answer: b. Each slow client holds a worker. Enough of them use up every worker.

1. Which nginx directive limits request rate?

• [ ] a) server_tokens
• [x] b) limit_req_zone
• [ ] c) autoindex
• [ ] d) ssl_ciphers
• Answer: b. limit_req_zone defines a shared rate limit, applied with limit_req.

1. Which Apache module protects against slow requests?

• [ ] a) mod_rewrite
• [x] b) mod_reqtimeout
• [ ] c) mod_ssl
• [ ] d) mod_status
• Answer: b. mod_reqtimeout sets minimum read rates for headers and bodies.

1. Who must approve a real load test?

• [ ] a) Nobody
• [x] b) The system owner and, where relevant, the hosting provider, in writing
• [ ] c) Any team member
• [ ] d) Only the firewall
• Answer: b. Load tests can affect shared infrastructure, so written approval comes first.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• nginx documentation, ngx_http_limit_req_module: https://nginx.org/en/docs/http/ngx_http_limit_req_module.html
• Apache HTTP Server, mod_reqtimeout: https://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.