Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A global digital healthcare platform provides telehealth services through an Application Load Balancer (ALB) in the us-east-1 Region. The platform is experiencing intermittent latency due to a surge in malicious traffic, including distributed denial of service (DDoS) attempts at the network layer and SQL injection attempts at the application layer. The company needs to implement a solution that caches static healthcare resources at the edge, mitigates L3/L4 DDoS attacks, and blocks L7 malicious exploits before they reach the ALB. Which combination of configurations should a solutions architect implement to meet these requirements? (Select TWO.)

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache static assets and utilize built-in AWS Shield Standard for Layer 3 and Layer 4 protection.Answer
  2. Create an AWS WAF web ACL with SQL injection protection rules and associate it with the Amazon CloudFront distribution.Answer
  3. C
    Enable AWS Shield Standard on the Application Load Balancer and configure it to inspect and block Layer 7 SQL injection attacks.
  4. D
    Configure stateless Network Access Control Lists (NACLs) at the subnet level to perform deep packet inspection and filter out SQL injection patterns.
  5. E
    Configure the Application Load Balancer security groups to block traffic originating from outside the local VPC CIDR block.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer and associate an AWS WAF web ACL with the CloudFront distribution.
Deploying an Amazon CloudFront distribution provides global edge caching and automatically includes AWS Shield Standard protection to mitigate Layer 3 and Layer 4 DDoS attacks. Associating an AWS WAF web ACL with the CloudFront distribution allows the inspection of incoming HTTP requests at the edge, blocking Layer 7 exploits such as SQL injection before they reach the origin Application Load Balancer.

Step-by-Step Solution

1
Address caching and Layer 3/4 DDoS protection at the edge.
Amazon CloudFront is deployed to cache static content at edge locations. Traffic routed through CloudFront is automatically protected by AWS Shield Standard against infrastructure DDoS attacks.
This offloads traffic from the Application Load Balancer and mitigates L3/L4 network-layer threats before they hit internal systems.
2
Address Layer 7 SQL injection protection.
An AWS WAF web ACL is created with rules to detect SQL injection and is associated with the Amazon CloudFront distribution.
AWS WAF provides the deep packet inspection capabilities needed to inspect HTTP request bodies and block SQL injection attempts at the edge network.
3
Evaluate and eliminate incorrect firewall configurations.
Reject subnet Network ACLs and security groups as solutions for SQL injection protection.
NACLs and security groups operate at Layer 4 and cannot inspect Layer 7 payload content. Additionally, blocking external traffic via security groups would make the public platform inaccessible.

Key Concept

Combining Amazon CloudFront, AWS Shield Standard, and AWS WAF at the AWS edge to protect applications against Layer 3/4 DDoS and Layer 7 exploits.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic