Examkin

Question

Difficulty: MediumEdge and DDoS Protection

An online auction platform experiences intermittent performance degradation during high-traffic bidding events due to sophisticated Layer 7 HTTP flood attacks and cross-site scripting (XSS) attempts. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). Which solution should a solutions architect implement to mitigate these attacks at the AWS network edge before they reach the application?

  1. A
    Enable AWS Shield Standard on the Application Load Balancer, and configure stateless Network Access Control Lists (NACLs) to inspect incoming HTTP requests for XSS payloads.
  2. Deploy Amazon CloudFront in front of the Application Load Balancer. Associate an AWS WAF web ACL with the CloudFront distribution, and configure a rate-based rule and a cross-site scripting (XSS) match rule.Answer
  3. C
    Configure EC2 security groups on the Application Load Balancer to inspect HTTP requests for XSS strings, and configure a Network Access Control List (NACL) to rate-limit traffic at the subnet level.
  4. D
    Associate an AWS WAF web ACL directly with the Application Load Balancer, and configure AWS Shield Standard to automatically block Layer 7 XSS exploits and rate-limit incoming HTTP traffic.

Answer

Deploy Amazon CloudFront in front of the Application Load Balancer, associate an AWS WAF web ACL with the CloudFront distribution, and configure a rate-based rule and a cross-site scripting (XSS) match rule.
Deploying Amazon CloudFront in front of the Application Load Balancer puts the entry point at the AWS network edge. Associating AWS WAF with the CloudFront distribution allows traffic to be inspected and filtered at edge locations. Rate-based rules in AWS WAF mitigate Layer 7 HTTP floods, and XSS match conditions block exploit attempts before they reach the Application Load Balancer and the backend instances.

Step-by-Step Solution

1
Identify where edge mitigation must occur.
Determine that Amazon CloudFront is the content delivery network that operates at global AWS edge locations, providing an entry point outside the primary AWS region.
Deploying CloudFront ensures that incoming traffic is intercepted and inspected at the network edge before reaching regional infrastructure.
2
Select the appropriate tool for Layer 7 inspection and rate limiting.
Choose AWS WAF to create Web ACLs with rate-limiting rules (for HTTP floods) and custom inspection rules (for XSS).
Layer 4 components like Security Groups and Network ACLs cannot inspect HTTP request payloads or selectively block based on application signatures.
3
Integrate AWS WAF at the edge layer.
Associate the AWS WAF Web ACL with the Amazon CloudFront distribution.
This configuration filters malicious traffic at the CloudFront edge locations, blocking attacks before they travel to the Application Load Balancer and the backend EC2 instances.

Key Concept

Using Amazon CloudFront in combination with AWS WAF protects web applications against Layer 7 DDoS (HTTP floods) and application exploits at the AWS network edge, preventing malicious traffic from reaching regional load balancers.
Estimated Time:1m 30s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic