Examkin

Question

Difficulty: Very hardEdge Caching and Content Delivery for Resilient Architectures

A global company hosts a dynamic financial API across Application Load Balancers (ALBs) in the us-east-1 (primary) and eu-west-1 (secondary standby) Regions. The API requires ultra-low latency SSL/TLS handshakes, protection against Layer 7 SQL injection attacks, and immediate failover to the secondary region if the primary region's ALB starts returning HTTP 502 or 504 errors. The failover process must occur within seconds without relying on client-side DNS updates, and operational complexity must be kept to a minimum. Which of the following combinations of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create an Amazon CloudFront distribution and configure an origin group containing the us-east-1 ALB as the primary origin and the eu-west-1 ALB as the secondary origin, setting the failover criteria to include 502 and 504 status codes.Answer
  2. Associate an AWS WAF web ACL directly with the Amazon CloudFront distribution to inspect incoming requests at the edge before they reach the ALBs.Answer
  3. C
    Configure an Amazon Route 53 latency-based routing policy to distribute traffic between the two regional ALBs, and use Route 53 health checks to automatically redirect traffic to the secondary ALB during an outage.
  4. D
    Configure an AWS Global Accelerator in front of the regional ALBs and enable AWS Shield Standard on the accelerator to block Layer 7 SQL injection attacks.
  5. E
    Deploy Amazon CloudFront and configure a Route 53 failover routing policy that points to the regional ALBs, utilizing AWS WAF on the individual ALBs.

Answer

The solutions architect should create an Amazon CloudFront distribution with an origin group containing the primary us-east-1 ALB and the secondary eu-west-1 ALB (with failover criteria for 502 and 504 errors), and associate an AWS WAF web ACL directly with the CloudFront distribution.
Configuring CloudFront Origin Groups ensures that failover between the primary ALB in us-east-1 and the standby ALB in eu-west-1 happens within seconds at the CDN edge level, bypassing client-side DNS caching. Associating AWS WAF with CloudFront provides L7 security inspection at the edge, reducing latency and operational complexity by avoiding the management of multiple regional WAF ACLs.

Step-by-Step Solution

1
Analyze the requirements for edge caching, low-latency handshakes, second-level failover, and Layer 7 protection.
Identify that DNS-based failover (Route 53) is too slow (minutes) due to TTL caching, whereas CloudFront Origin Groups handle failover at the CDN layer within seconds.
Choosing the correct failover mechanism is critical to meet the strict recovery time objective (seconds) and minimize handshake latency globally.
2
Select the edge-level resiliency configuration.
Determine that a CloudFront distribution with origin groups configured for failover on HTTP 502 and 504 codes matches the requirements.
This allows CloudFront to immediately retry requests on the secondary origin when the primary returns error responses, without requiring client DNS updates.
3
Evaluate security requirements for Layer 7 SQL injection protection.
Select AWS WAF associated directly with the CloudFront distribution to inspect traffic at the edge.
This provides L7 protection before traffic reaches the ALBs, reduces origin load, and simplifies operations compared to deploying regional WAFs on individual ALBs. AWS Shield Standard does not provide Layer 7 application filtering.

Key Concept

CloudFront Origin Groups provide sub-second failover for origin endpoints, while AWS WAF at the edge provides centralized Layer 7 protection and reduces latency by filtering requests before they reach regional infrastructure.
Rate this question

Topics

Edge Caching and Content Delivery for Resilient Architectures

More questions from this topic