Examkin

Question

Difficulty: MediumEdge and DDoS Protection

An enterprise project management SaaS platform hosts its application on AWS. The frontend is served via an Amazon S3 bucket behind an Amazon CloudFront distribution, and the backend APIs run on Amazon EC2 instances behind an Application Load Balancer (ALB). The platform recently suffered from a HTTP flood attack targeting the backend APIs, which degraded performance for users, as well as a series of SQL injection attempts.

The solutions architect must design a secure architecture that provides comprehensive DDoS protection and mitigates application-layer exploits. The solution must minimize origin exposure and block unauthorized HTTP traffic before it reaches the backend.

Which combination of actions should the solutions architect take? (Select TWO.)

  1. Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule along with AWS Managed Rules for SQL injection.Answer
  2. Configure the Application Load Balancer's security group to only accept inbound traffic from the Amazon CloudFront distribution using the CloudFront managed prefix list.Answer
  3. C
    Enable AWS Shield Advanced on the Application Load Balancer to inspect and block application-layer SQL injection attempts before they reach the backend EC2 instances.
  4. D
    Apply a stateful Network ACL to the subnets of the Application Load Balancer to restrict inbound traffic to the IP address ranges of the Amazon CloudFront distribution.
  5. E
    Configure a rate-limiting rule within AWS Shield Standard to automatically drop traffic from IP addresses that exceed request thresholds.

Answer

Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure the Application Load Balancer's security group to only accept inbound traffic from the CloudFront managed prefix list.
Associating an AWS WAF web ACL with the Amazon CloudFront distribution provides application-layer protection directly at the edge, allowing the system to inspect and filter out HTTP floods and SQL injection attempts before they reach the backend. Combining this with an Application Load Balancer security group configured to only accept traffic from the CloudFront managed prefix list prevents users from bypassing CloudFront to access the origin directly.

Step-by-Step Solution

1
Analyze the security requirements for the application.
The application requires protection against Layer 7 exploits (SQL injection), HTTP flood attacks (Layer 7 DDoS), and origin protection (minimizing direct exposure of the Application Load Balancer).
This establishes the scope of security controls needed at the edge and resource level.
2
Select the appropriate service for Layer 7 mitigation.
AWS WAF associated with Amazon CloudFront provides rate limiting to block HTTP floods and managed rule sets to block SQL injection at the edge.
AWS WAF is designed for application-layer (Layer 7) filtering and protection, whereas AWS Shield Standard/Advanced primarily protects Layers 3 and 4.
3
Restrict access to the Application Load Balancer.
Configure the security group of the ALB to permit traffic only from the Amazon CloudFront distribution by referencing the CloudFront managed prefix list.
This prevents attackers from bypassing the CloudFront distribution and AWS WAF to hit the origin directly, while leveraging stateful security groups.

Key Concept

Mitigating web application-layer attacks (Layer 7) using AWS WAF on CloudFront and securing origin resources using security groups with managed prefix lists.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic