Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A municipal transit authority operates a real-time vehicle tracking API endpoint on AWS. The API is deployed behind an Application Load Balancer (ALB) and receives rapid HTTP requests from commuter mobile applications. The authority needs to protect the infrastructure from volumetric Layer 3/4 DDoS attacks and prevent clients from overwhelming the backend EC2 instances with high-rate Layer 7 HTTP GET requests. Which combination of AWS configurations should a solutions architect implement to meet these security requirements? (Select TWO.)

  1. Enable AWS Shield Advanced on the Application Load Balancer to provide automatic mitigation against infrastructure-layer volumetric attacks.Answer
  2. Deploy AWS WAF with a rate-based rule associated with the Application Load Balancer to block clients exceeding request thresholds.Answer
  3. C
    Configure stateful Network Access Control Lists (NACLs) at the subnet boundaries to automatically identify and block IP addresses generating excessive HTTP traffic.
  4. D
    Rely on AWS Shield Standard to inspect incoming application-layer payloads and automatically block SQL injection and HTTP flood exploits.
  5. E
    Implement Security Groups on the backend EC2 instances with ingress rules set to dynamically block individual source IP addresses that send rapid requests.

Answer

Enable AWS Shield Advanced on the Application Load Balancer to protect against infrastructure-layer volumetric attacks, and deploy AWS WAF with a rate-based rule associated with the Application Load Balancer to block clients exceeding HTTP request rate thresholds.
Implementing AWS Shield Advanced on the Application Load Balancer provides dedicated protection against volumetric Layer 3 and Layer 4 infrastructure attacks. Simultaneously, associating AWS WAF with a rate-based rule on the Application Load Balancer dynamically mitigates Layer 7 HTTP flood attacks by tracking request rates from individual client IPs and blocking those that exceed safe thresholds.

Step-by-Step Solution

1
Address the infrastructure-layer (Layer 3 and 4) volumetric DDoS protection requirement.
Enable AWS Shield Advanced on the Application Load Balancer.
AWS Shield Advanced provides active mitigation against volumetric Layer 3/4 attacks specifically tailored to protected AWS resources like Application Load Balancers.
2
Address the application-layer (Layer 7) protection and rate-limiting requirement.
Create an AWS WAF Web ACL containing a rate-based rule and associate it with the Application Load Balancer.
AWS WAF rate-based rules evaluate client requests over a sliding window (e.g., 5 minutes) and block traffic from client IPs that exceed the specified limit, protecting backend EC2 instances from HTTP floods.

Key Concept

Edge protection requires a layered approach: AWS Shield Advanced for L3/L4 volumetric protection, and AWS WAF with rate-based rules for L7 application-layer mitigation.
Estimated Time:2m 0s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic