Examkin

Question

Difficulty: HardEdge and DDoS Protection

A global online gaming company hosts its multiplayer matchmaking API on Amazon ECS container instances behind an Application Load Balancer (ALB). The company recently suffered a major distributed denial of service (DDoS) attack in the form of an HTTP flood, which overwhelmed the ALB and caused matchmaking services to fail. Additionally, the security team has identified SQL injection attempts in the request payloads. The company wants to implement a solution to mitigate these Layer 7 attacks, minimize latency for global players, and restrict direct access to the ALB, allowing traffic only from the edge security layer. Which two actions should a solutions architect recommend to meet these requirements? (Select TWO.)

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the distribution that includes a rate-based rule and SQL injection protection rules.Answer
  2. Configure the security group of the Application Load Balancer to allow inbound HTTP/HTTPS traffic only from the Amazon CloudFront managed prefix list.Answer
  3. C
    Enable AWS Shield Advanced on the Application Load Balancer to automatically inspect HTTP request payloads and mitigate SQL injection attempts.
  4. D
    Configure a stateless Network Access Control List (NACL) on the Application Load Balancer's subnets to inspect incoming request bodies for SQL injection patterns and block them.
  5. E
    Deploy an AWS WAF web ACL and associate it directly with the Amazon ECS service to filter malicious payloads before they reach the containers.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer with AWS WAF associated, and restrict the load balancer's security group to allow inbound traffic only from the CloudFront managed prefix list.
Deploying CloudFront in front of the ALB caches content globally to reduce latency. Associating AWS WAF with CloudFront allows filtering of Layer 7 exploits like SQL injection and mitigating HTTP flood attacks using rate-based rules at the edge. Restricting the ALB security group to the CloudFront managed prefix list ensures that all public traffic must pass through the CloudFront and WAF edge security layer before reaching the backend.

Step-by-Step Solution

1
Introduce Amazon CloudFront to cache content globally, reducing latency, and provide a point of integration for AWS WAF at the AWS edge network.
Latency is reduced for global users, and the attack surface is shifted to the AWS edge.
CloudFront routes traffic through the AWS global network and integrates directly with AWS WAF.
2
Configure an AWS WAF Web ACL containing rate-based rules to block HTTP flood attacks and custom/managed rules to inspect payloads and block SQL injection exploits.
Layer 7 attacks (HTTP floods and SQL injection) are blocked at the edge.
AWS WAF inspects HTTP/HTTPS traffic at Layer 7 and can enforce rate limits and payload inspections.
3
Modify the Application Load Balancer's security group to restrict inbound traffic to the Amazon CloudFront managed prefix list, ensuring direct access to the origin is blocked.
Direct public access to the load balancer is prevented, forcing all traffic through CloudFront.
Securing the origin ensures attackers cannot bypass AWS WAF by sending requests directly to the ALB's public IP address.

Key Concept

Implementing Layer 7 DDoS and exploit mitigation at the edge using Amazon CloudFront and AWS WAF while securing the origin ALB.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic