Examkin

Question

Difficulty: HardEdge and DDoS Protection

A global event ticketing platform hosts its high-traffic booking application on AWS using Amazon EC2 instances behind an Application Load Balancer (ALB). During major ticket releases, the platform experiences sudden spikes in malicious traffic, including Layer 7 HTTP flood attacks that exhaust web server resources, and periodic SQL injection attempts. The solutions architect needs to secure the architecture to mitigate these threats at the network edge while minimizing administrative overhead and ensuring only legitimate users can complete purchases. Which combination of steps should the solutions architect implement to meet these requirements? (Select TWO.)

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing rate-based rules and SQL injection matching conditions with the CloudFront distribution.Answer
  2. Subscribe to AWS Shield Advanced, associate it with the Amazon CloudFront distribution, and enable automatic application-layer DDoS mitigation.Answer
  3. C
    Configure stateless Network Access Control Lists (NACLs) at the subnet level to dynamically identify and block the source IP addresses of the HTTP flood attacks.
  4. D
    Enable AWS Shield Standard on the Application Load Balancer and configure security groups to inspect HTTP payloads and rate-limit requests.
  5. E
    Associate an AWS WAF web ACL directly with the Amazon EC2 instances in the private subnets to block malicious traffic before it runs database queries.

Answer

Deploy an Amazon CloudFront distribution in front of the ALB and associate it with an AWS WAF web ACL containing rate-based and SQL injection rules, while subscribing to AWS Shield Advanced and enabling automatic application-layer DDoS mitigation on the distribution.
The combination of deploying Amazon CloudFront with AWS WAF and subscribing to AWS Shield Advanced with automatic application-layer DDoS mitigation represents the AWS-recommended best practice for edge protection. CloudFront moves the application perimeter to the edge, AWS WAF provides Layer 7 payload filtering (such as SQL injection patterns and rate limiting), and Shield Advanced automates WAF rule creation and mitigation during an active DDoS attack, thereby reducing operational overhead.

Step-by-Step Solution

1
Shift the application entry point to the edge by deploying an Amazon CloudFront distribution in front of the Application Load Balancer.
Dynamic and static traffic is routed through AWS edge locations, caching static content and providing a global scale capable of absorbing Layer 3 and Layer 4 infrastructure DDoS attacks.
Protecting the Application Load Balancer from direct internet exposure ensures that attacks are inspected and mitigated before reaching the core infrastructure.
2
Associate an AWS WAF web ACL with the Amazon CloudFront distribution and define rate-based rules along with SQL injection protection rules.
Layer 7 traffic is inspected at the edge. Request rates per IP are monitored to block HTTP floods, and payloads are analyzed to filter SQL injection attempts before forwarding traffic to the ALB.
AWS WAF provides application-layer visibility and control, preventing malicious payloads and resource exhaustion at the edge.
3
Enable AWS Shield Advanced on the Amazon CloudFront distribution and turn on automatic application-layer DDoS mitigation.
AWS Shield Advanced analyzes historical traffic baselines and automatically deploys custom WAF rules when an application-layer DDoS attack is detected.
This automates the mitigation process, minimizing administrative overhead and reducing the time to respond to complex, changing attack vectors.

Key Concept

Mitigating Layer 7 application attacks and DDoS at the edge using Amazon CloudFront, AWS WAF, and AWS Shield Advanced.
Estimated Time:2m 30s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic