Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A global SaaS provider hosts a multi-tenant application on AWS. The entry point is an Amazon CloudFront distribution that forwards requests to an Application Load Balancer (ALB) backed by Amazon EC2 instances in private subnets. During a promotional event, the application experiences a massive distributed denial of service (DDoS) attack consisting of a Layer 3/4 SYN flood and a Layer 7 HTTP flood. This causes resource exhaustion at the ALB level. A solutions architect needs to design a mitigation strategy to protect the application from future attacks of both types at the edge, while minimizing administrative overhead.

Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Associate an AWS WAF web ACL with the CloudFront distribution and create a rate-based rule to block clients that exceed a threshold of requests.Answer
  2. Subscribe to AWS Shield Advanced and enable protection for the CloudFront distribution to leverage automatic Layer 3 and Layer 4 mitigation.Answer
  3. C
    Rely on the default AWS Shield Standard subscription to inspect and filter out the Layer 7 HTTP flood attacks before they reach the Application Load Balancer.
  4. D
    Implement stateless Network Access Control Rules (NACLs) on the subnets containing the Application Load Balancer to dynamically filter out the malicious Layer 7 request patterns.
  5. E
    Configure Security Groups on the EC2 instances to rate-limit incoming connections from individual IP addresses to mitigate the SYN flood.

Answer

Associate an AWS WAF web ACL with the CloudFront distribution with a rate-based rule to block high-volume clients, and subscribe to AWS Shield Advanced to enable protection for the CloudFront distribution to leverage automated Layer 3 and Layer 4 mitigation.
The correct architecture uses a combination of AWS WAF and AWS Shield Advanced associated with Amazon CloudFront. The rate-based rule in AWS WAF inspects HTTP requests at the edge and automatically blocks clients that exceed rate thresholds, mitigating the Layer 7 HTTP flood. Subscribing to AWS Shield Advanced and protecting the CloudFront distribution mitigates Layer 3 and Layer 4 infrastructure attacks, such as SYN floods, at the edge before they can consume resources on the Application Load Balancer.

Step-by-Step Solution

1
Analyze the attack vectors to determine the target layers of the traffic floods.
Identify that the SYN flood is a Layer 3/4 infrastructure attack, whereas the HTTP flood is a Layer 7 application-layer attack.
Correct service selection requires distinguishing between network/transport layer attacks and application-layer exploits.
2
Mitigate the Layer 7 HTTP flood at the edge before it reaches the Application Load Balancer.
Configure AWS WAF with a rate-based rule and associate it with the CloudFront distribution.
AWS WAF inspects HTTP traffic at edge locations and can drop requests from offending IP addresses when rate thresholds are crossed.
3
Mitigate the Layer 3/4 infrastructure SYN flood at the edge before it exhausts ALB capacity.
Protect the CloudFront distribution with AWS Shield Advanced.
AWS Shield Advanced offers advanced monitoring, automated mitigation of infrastructure attacks at the CloudFront edge, and support from the Shield Response Team.

Key Concept

Edge and DDoS Protection
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic