Examkin

Question

Difficulty: Very hardEdge and DDoS Protection

A B2B software-as-a-service (SaaS) provider hosts a multi-tenant enterprise application on AWS. The application architecture has two primary entry points exposed via an Application Load Balancer (ALB): a custom TCP-based protocol endpoint for real-time telemetry ingestion, and an HTTPS REST API for analytical reporting. During a recent audit, the security team identified a vulnerability to Layer 3/4 DDoS attacks targeting the TCP endpoint and Layer 7 HTTP flood attacks targeting the REST API. The provider has subscribed to AWS Shield Advanced and wants to implement a solution that mitigates these threats while minimizing latency for global tenants. Which TWO solutions should a solutions architect implement to meet these requirements?

  1. Create an AWS Global Accelerator accelerator for the custom TCP telemetry endpoint, route traffic to the Application Load Balancer, and enable AWS Shield Advanced on the accelerator.Answer
  2. Deploy an Amazon CloudFront distribution in front of the HTTPS REST API, associate an AWS WAF web ACL with the distribution, and configure a rate-limiting rule.Answer
  3. C
    Configure stateless Network Access Control Lists (NACLs) at the subnet level to dynamically block offending IP addresses during a Layer 3/4 DDoS attack on the telemetry endpoint.
  4. D
    Deploy an Amazon CloudFront distribution to cache static responses for both the custom TCP telemetry endpoint and the HTTPS REST API, and enable AWS Shield Standard on the distribution.
  5. E
    Configure AWS WAF on the Application Load Balancer to inspect and mitigate Layer 3/4 TCP protocol attacks, and rely on default AWS Shield Standard behavior to automatically mitigate Layer 7 HTTP flood attacks.

Answer

The correct solutions are to create an AWS Global Accelerator accelerator for the custom TCP telemetry endpoint, route traffic to the Application Load Balancer, and enable AWS Shield Advanced on the accelerator; and to deploy an Amazon CloudFront distribution in front of the HTTPS REST API, associate an AWS WAF web ACL with the distribution, and configure a rate-limiting rule.
The solution requires separate strategies for the custom TCP protocol and the HTTP/HTTPS protocol. For the custom TCP protocol, AWS Global Accelerator is used because CloudFront does not support custom TCP traffic. Enabling AWS Shield Advanced on the accelerator protects the TCP endpoint from Layer 3/4 DDoS attacks. For the HTTPS REST API, Amazon CloudFront is deployed, and an AWS WAF web ACL with a rate-limiting rule is associated with the distribution to protect against Layer 7 HTTP flood attacks at the edge before they hit the origin Application Load Balancer.

Step-by-Step Solution

1
Analyze the protocols used by the application endpoints.
The telemetry endpoint uses a custom TCP-based protocol, while the analytical reporting endpoint uses HTTP/HTTPS.
This determines which edge services are compatible. CloudFront only supports HTTP, HTTPS, and RTMP, whereas AWS Global Accelerator supports both TCP and UDP protocols.
2
Select the appropriate edge service for the custom TCP endpoint.
AWS Global Accelerator is selected because it routes TCP traffic over the AWS global network, reducing latency and providing static IP addresses that act as a front end.
This satisfies the low-latency requirement for the custom TCP endpoint while keeping the origin infrastructure shielded.
3
Select the appropriate edge service for the HTTPS REST API endpoint.
Amazon CloudFront is selected as the content delivery network (CDN) to serve the HTTPS REST API.
CloudFront caches responses at edge locations, integrates with AWS WAF, and provides built-in Layer 3/4 DDoS protection.
4
Determine the mitigation strategy for Layer 3/4 attacks on the TCP endpoint.
Enable AWS Shield Advanced on the AWS Global Accelerator resource.
AWS Shield Advanced integrates with Global Accelerator to provide resource-specific monitoring and mitigation of sophisticated Layer 3/4 DDoS attacks.
5
Determine the mitigation strategy for Layer 7 HTTP flood attacks on the HTTPS REST API.
Associate an AWS WAF web ACL with the CloudFront distribution and add a rate-limiting rule.
AWS WAF inspects HTTP/HTTPS requests at the edge. A rate-limiting rule temporarily blocks client IP addresses that exceed a configured request threshold, mitigating Layer 7 floods before they reach the ALB.

Key Concept

AWS Edge Security Architecture using CloudFront, Global Accelerator, AWS WAF, and AWS Shield Advanced
Estimated Time:3m 0s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic