Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A SaaS company hosts an online learning platform on AWS. The application uses Amazon EC2 instances behind an Application Load Balancer (ALB). During peak registration periods, the platform experiences HTTP flood attacks targeting the user login URI, which causes application downtime. The company wants to implement a scalable, cost-effective solution to mitigate these Layer 7 attacks without impacting legitimate users. Which two actions should the solutions architect take to meet these requirements? (Select TWO).

  1. Configure an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the CloudFront distribution.Answer
  2. Create an AWS WAF rate-based rule targeting the login URI to block requests from clients exceeding a request threshold.Answer
  3. C
    Associate an AWS Shield Standard subscription with the Application Load Balancer to automatically mitigate application-layer (Layer 7) HTTP flood attacks.
  4. D
    Configure a stateless Network Access Control List (NACL) at the subnet level to dynamically filter and inspect the payloads of incoming HTTP requests.
  5. E
    Add rules to the Application Load Balancer's security group to track client connection rates and drop traffic from offending IP addresses.

Answer

To protect the application from Layer 7 HTTP flood attacks targeting a specific login URI, the solutions architect should deploy Amazon CloudFront in front of the Application Load Balancer and associate an AWS WAF web ACL. Within the web ACL, a rate-based rule should be configured targeting the specific login URI path to limit the rate of requests from any single IP address.
Deploying Amazon CloudFront in front of the Application Load Balancer allows traffic to be distributed across AWS edge locations. By attaching AWS WAF to the CloudFront distribution, requests are inspected before they reach the ALB origin. Designing a rate-based rule within AWS WAF that targets the login path allows the system to block traffic from IP addresses that exceed a specified threshold of requests within a five-minute window, effectively mitigating the HTTP flood.

Step-by-Step Solution

1
Deploy edge protection by placing Amazon CloudFront in front of the Application Load Balancer.
This distributes incoming traffic across edge locations and absorbs bulk traffic at the AWS perimeter.
DDoS protection should be handled as close to the user as possible to avoid overloading origin resources.
2
Associate AWS WAF with the CloudFront distribution.
Enables Layer 7 application-layer inspection and security rule enforcement at AWS edge locations.
HTTP flood attacks operate at Layer 7, requiring AWS WAF to inspect specific HTTP headers, methods, and paths.
3
Create a rate-based rule in AWS WAF targeting the login URI.
Monitors the frequency of incoming requests to the login endpoint and blocks or challenges clients exceeding the threshold.
This mitigates the attack at the targeted endpoint while allowing legitimate traffic to other parts of the application.

Key Concept

Implementing Layer 7 DDoS mitigation at the edge using Amazon CloudFront and AWS WAF rate-based rules.
Estimated Time:2m 0s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic