Examkin

Question

Difficulty: HardEdge and DDoS Protection

A global e-commerce company hosts its application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of Amazon EC2 instances. The company's security team detects two concurrent security events during a high-traffic sale: a volumetric UDP flood attack targeting the application's infrastructure, and a distributed HTTP GET flood targeting a database-intensive search endpoint (/api/v1/search) using randomized query parameters to bypass caching. The company requires a solution that automatically mitigates the volumetric traffic, provides application-layer protection for the search endpoint, secures cost protection against EC2 scaling charges incurred by the attack traffic, and grants 24/7 access to the AWS Shield Response Team (SRT). Which architecture meets these requirements with the least operational overhead?

  1. Enable AWS Shield Advanced on the Application Load Balancer. Associate AWS WAF with the Application Load Balancer, and create a rate-based rule that inspects request parameters and matches the search endpoint path.Answer
  2. B
    Enable AWS Shield Standard to mitigate the volumetric UDP flood. Implement a Network Access Control List (NACL) rule on the public subnets to block the HTTP GET request flood targeting the search path, and contact AWS Support to engage the Shield Response Team.
  3. C
    Enable AWS Shield Advanced on the Application Load Balancer. Configure the Application Load Balancer's security group to deny incoming UDP traffic on all ports, and rely on AWS Shield Standard's automatic Layer 7 mitigation to throttle the HTTP GET flood on the search endpoint.
  4. D
    Associate AWS WAF with the Application Load Balancer, and configure a custom rule to inspect and block the volumetric UDP traffic. Set up a stateful Security Group rule on the EC2 instances to dynamically block IP addresses performing the HTTP GET flood on the search path.

Answer

Enable AWS Shield Advanced on the Application Load Balancer, associate AWS WAF with the Application Load Balancer, and configure an AWS WAF rate-based rule targeting the search endpoint path.
The correct architecture leverages AWS Shield Advanced on the Application Load Balancer for automated mitigation of infrastructure-layer (Layer 3/4) attacks like UDP floods, cost protection to offset EC2 scaling charges incurred during a DDoS attack, and 24/7 access to the Shield Response Team. In addition, an AWS WAF rate-based rule is associated with the ALB to inspect HTTP requests and throttle clients that send high-volume HTTP GET requests to the resource-intensive search endpoint.

Step-by-Step Solution

1
Select AWS Shield Advanced for L3/L4 volumetric protection, cost protection, and SRT access.
Automatic mitigation of UDP floods at the AWS edge, reimbursement for scale-out costs, and 24/7 access to the Shield Response Team are enabled.
AWS Shield Standard does not cover scale-out costs or provide SRT support, which are critical requirements.
2
Deploy AWS WAF and associate it with the Application Load Balancer.
Layer 7 HTTP traffic can now be inspected at the load balancer layer.
Layer 7 mitigation requires AWS WAF since network firewalls and NACLs cannot inspect HTTP request payloads or paths.
3
Configure an AWS WAF rate-based rule matching the '/api/v1/search' URI path.
HTTP requests targeting the search endpoint are automatically throttled when they exceed the defined rate limit threshold.
A rate-based rule limits the rate of requests from any single IP address, mitigating HTTP GET flood attacks that attempt to bypass caching using randomized query parameters.

Key Concept

AWS Shield Advanced offers Layer 3 and Layer 4 DDoS protection, cost protection for scaled-out resources, and SRT engagement, while AWS WAF provides Layer 7 mitigation (such as rate-limiting) for specific application endpoints.
Estimated Time:2m 30s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic