For Teachers · Back to the Module · Print with your browser's Print command.

P25 Worksheet: Availability Without Load Testing

Student Worksheet (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F3

Learning Objectives

• [ ] Explain the difference between performance testing and a configuration review.
• [ ] Name the settings that limit request rate, size and duration.
• [ ] Know when real load testing is appropriate and who must approve it.

Key Terms

Write each definition in your own words.

• Rate Limiting: ______________________________________________
• Slowloris: ______________________________________________
• Intrusion Prevention: ______________________________________________
• Brute Force: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo vulnerable --only WEB-APA-011,WEB-NGX-006 --out p25 and list the missing limits.
2. Write the nginx lines that add a login rate limit of 10 requests per minute per address.

Self-Check Questions

1. Why does OpenVAPT not send heavy traffic to test availability?

• [ ] a) It is too slow
• [ ] b) Heavy traffic can take a service down and, without permission, is an attack
• [ ] c) Servers block it anyway
• [ ] d) It needs a paid licence

1. What does a slow request attack (Slowloris) exploit?

• [ ] a) Weak passwords
• [ ] b) Workers kept busy by clients that send requests very slowly
• [ ] c) Old TLS versions
• [ ] d) Large images

1. Which nginx directive limits request rate?

• [ ] a) server_tokens
• [ ] b) limit_req_zone
• [ ] c) autoindex
• [ ] d) ssl_ciphers

1. Which Apache module protects against slow requests?

• [ ] a) mod_rewrite
• [ ] b) mod_reqtimeout
• [ ] c) mod_ssl
• [ ] d) mod_status

1. Who must approve a real load test?

• [ ] a) Nobody
• [ ] b) The system owner and, where relevant, the hosting provider, in writing
• [ ] c) Any team member
• [ ] d) Only the firewall

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• nginx documentation, ngx_http_limit_req_module: https://nginx.org/en/docs/http/ngx_http_limit_req_module.html
• Apache HTTP Server, mod_reqtimeout: https://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.