Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A municipal transit agency hosts its online ticketing application on AWS using an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances. Recently, the application has experienced intermittent outages caused by HTTP flood attacks that mimic legitimate user login requests. The agency needs to implement a solution that mitigates these Layer 7 attacks at the AWS edge before they reach the ALB, without requiring changes to the application code. Which architecture should a solutions architect recommend to meet these requirements?

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the distribution using a rate-based rule.Answer
  2. B
    Enable AWS Shield Standard on the Application Load Balancer and configure a custom protection group to automatically block HTTP floods.
  3. C
    Configure the Application Load Balancer security group with a custom rule to rate-limit incoming traffic from untrusted public IP addresses.
  4. D
    Apply a stateless Network Access Control List (NACL) to the load balancer subnets to dynamically inspect and rate-limit HTTP requests.

Answer

Deploying an Amazon CloudFront distribution in front of the Application Load Balancer, and associating an AWS WAF web ACL with the distribution using a rate-based rule.
The correct solution uses Amazon CloudFront to cache and distribute traffic, and integrates it with AWS WAF at the AWS edge. A rate-based rule in the WAF web ACL automatically counts requests from individual IP addresses and blocks them when they exceed the defined limit, mitigating Layer 7 HTTP flood attacks before they reach the Application Load Balancer.

Step-by-Step Solution

1
Analyze the attack vector and mitigation requirements.
Identify that the attack is a Layer 7 (HTTP flood) attack causing outages at the application layer, requiring a solution that operates at the AWS edge and offers rate-limiting.
Layer 7 attacks cannot be mitigated by standard network-level firewalls alone and must be inspected for request patterns.
2
Select the correct edge and application security services.
Amazon CloudFront distributes traffic via edge locations globally, and AWS WAF integrates with CloudFront to block malicious Layer 7 traffic before it reaches the backend infrastructure.
Filtering traffic at the edge reduces the load on the Application Load Balancer and downstream application servers.
3
Configure AWS WAF rules for request control.
Implement an AWS WAF rate-based rule to automatically track request rates from individual client IPs and temporarily block IPs exceeding the threshold.
Rate-limiting is the standard, code-free method to protect against HTTP flood attacks that mimic legitimate login requests.

Key Concept

Mitigating Layer 7 DDoS attacks using Amazon CloudFront and AWS WAF rate-based rules at the AWS edge.
Estimated Time:1m 30s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic