Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A media streaming platform serves static content and an interactive API via an Amazon CloudFront distribution. The API traffic is routed to an Application Load Balancer (ALB) acting as the origin. During a recent event, the platform experienced a massive distributed HTTP flood attack targeting the login endpoint (/login), which overwhelmed the backend EC2 instances. The security team needs a solution to automatically detect and block these application-layer attacks at the edge with minimal administrative overhead. Which solution meets these requirements?

  1. Create an AWS WAF web ACL, define a rate-based rule that targets the /login path, and associate the web ACL with the CloudFront distribution.Answer
  2. B
    Enable AWS Shield Standard to automatically detect and mitigate the application-layer HTTP flood attacks targeting the /login path.
  3. C
    Configure a stateless Network Access Control List (NACL) rule on the ALB's subnets to block the incoming traffic from the attacker IP addresses.
  4. D
    Configure the CloudFront cache behavior for the /login path with a Time to Live (TTL) of zero to block the unauthorized requests at the edge.

Answer

Create an AWS WAF web ACL, define a rate-based rule that targets the /login path, and associate the web ACL with the CloudFront distribution.
AWS WAF provides Layer 7 protection and allows you to create rate-based rules. When associated with an Amazon CloudFront distribution, AWS WAF inspects requests at the edge and automatically blocks IP addresses that exceed a defined threshold of requests within a rolling 5-minute window. This stops the HTTP flood from reaching the origin Application Load Balancer and the backend instances.

Step-by-Step Solution

1
Analyze the attack type and target layer.
The attack is a distributed HTTP flood targeting a specific application path (/login), which is a Layer 7 (application-layer) attack.
Correct security tools must operate at the application layer to inspect URI paths and request rates.
2
Select the appropriate AWS security service for Layer 7 mitigation.
AWS WAF is chosen because it allows inspection of HTTP/HTTPS parameters and supports rate-limiting rules.
AWS Shield Standard is restricted to Layer 3/4 protection, and Network ACLs lack application-layer visibility and automated rate detection.
3
Deploy the protection at the edge to protect the origin.
Associate the AWS WAF web ACL with the Amazon CloudFront distribution.
Blocking malicious traffic at the edge prevents it from traversing the AWS network and consuming ALB and EC2 resources.

Key Concept

Mitigating Layer 7 HTTP flood attacks at the edge using AWS WAF rate-based rules associated with Amazon CloudFront.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic