Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A global e-commerce company hosts its web application on Amazon EC2 instances behind an Application Load Balancer (ALB), utilizing Amazon CloudFront for content delivery. During a promotional event, the security team identifies a massive spike in HTTP POST requests targeting the `/login` endpoint from a distributed botnet. This Layer 7 traffic is bypassing cache and exhausting the compute capacity of the origin EC2 instances. The company needs to detect and block this application-layer attack at the edge before it reaches the backend infrastructure. Which solution should a solutions architect recommend?

  1. A
    Configure stateless Network Access Control Lists (NACLs) on the ALB subnets to deny inbound traffic from the source IP addresses generating the HTTP POST requests
  2. Deploy AWS WAF on the Amazon CloudFront distribution and configure a rate-based rule targeting the `/login` pathAnswer
  3. C
    Enable AWS Shield Standard on the Amazon CloudFront distribution to automatically filter the Layer 7 HTTP POST requests
  4. D
    Create an inbound rule in the Application Load Balancer's security group that denies traffic from the offending IP addresses on port 443

Answer

Deploy AWS WAF on the Amazon CloudFront distribution and configure a rate-based rule targeting the `/login` path
The correct solution is to deploy AWS WAF on the Amazon CloudFront distribution and create a rate-based rule for the `/login` path. AWS WAF operates at Layer 7 and is integrated with CloudFront at the AWS edge, allowing it to inspect HTTP/HTTPS request details like the request method (POST) and URI path. A rate-based rule tracks the number of requests originating from each IP address and blocks them once they exceed a defined threshold, effectively neutralizing the distributed botnet flood before the traffic reaches the backend ALB or EC2 origin.

Step-by-Step Solution

1
Analyze the attack vector and identify the target layer.
The attack consists of HTTP POST requests targeting a specific path (`/login`), which is a Layer 7 (application-layer) exploit bypassing cache.
This determines that network-level controls (Layer 3/4) alone will not suffice, and an application-aware firewall is required.
2
Select the appropriate AWS security service for edge protection.
Amazon CloudFront integrated with AWS WAF is chosen because AWS WAF inspects Layer 7 traffic and is deployed at the Edge locations.
Deploying the security control at the edge prevents malicious traffic from consuming bandwidth or compute resources at the origin ALB and EC2 layers.
3
Configure the detection and mitigation rule.
Create an AWS WAF rate-based rule that monitors requests to the `/login` URI path, blocking clients that exceed the specified request limit.
Rate-based rules automatically mitigate HTTP floods from distributed sources targeting specific high-load application endpoints.

Key Concept

Edge protection against Layer 7 application DDoS attacks using AWS WAF and Amazon CloudFront
Estimated Time:1m 30s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic