Examkin

Question

Difficulty: HardEdge and DDoS Protection

A digital publishing company serves personalized web content to a global audience. The content is hosted on origin servers in an on-premises data center, which is connected to AWS via an AWS Direct Connect connection. During major news events, the platform experiences sudden HTTP flood attacks (Layer 7) that exhaust the bandwidth on the Direct Connect connection, causing severe outages for legitimate users. The company needs to implement a solution to block these attacks at the AWS network edge before they reach the Direct Connect connection and the on-premises infrastructure. Which solution will meet these requirements?

  1. A
    Deploy an Application Load Balancer in the VPC, and configure stateful Network Access Control Lists (NACLs) to automatically block the attacking IP addresses at the subnet level before the traffic is routed over the Direct Connect link.
  2. B
    Configure Amazon Route 53 with latency-based routing to resolve queries to the on-premises servers, and rely on AWS Shield Standard to automatically detect and mitigate Layer 7 HTTP flood attacks at the DNS layer.
  3. Create an Amazon CloudFront distribution with the on-premises origin servers configured as the origin. Associate an AWS WAF web ACL with the CloudFront distribution, configure rate-based rules, and enable AWS Shield Advanced on the CloudFront distribution.Answer
  4. D
    Enable AWS Shield Standard on the Direct Connect gateway, and configure AWS WAF rules to inspect and filter traffic directly on the on-premises origin servers.

Answer

Create an Amazon CloudFront distribution with the on-premises origin servers configured as the origin, associate an AWS WAF web ACL with rate-based rules, and enable AWS Shield Advanced.
The correct solution uses Amazon CloudFront to intercept traffic at the AWS edge, which prevents malicious HTTP requests from traversing the Direct Connect link and exhausting the bandwidth of the on-premises origin. Associating an AWS WAF web ACL with rate-based rules blocks the Layer 7 HTTP flood attacks, and enabling AWS Shield Advanced on the CloudFront distribution provides advanced monitoring and automated Layer 7 mitigation.

Step-by-Step Solution

1
Analyze the entry point of the network traffic and identify where the bottleneck occurs.
The traffic traverses a Direct Connect connection to the on-premises origin, meaning any DDoS mitigation must happen at the AWS edge before entering the Direct Connect path.
This determines that resources inside the VPC or on-premises cannot protect the Direct Connect link bandwidth.
2
Select an AWS service that can act as a global entry point at the edge and integrate with layer 7 protection.
Amazon CloudFront can cache content, serve as the public entry point, and support AWS WAF and AWS Shield Advanced.
CloudFront routes traffic through the global AWS edge network, isolating the origin from direct internet exposure.
3
Apply Layer 7 mitigation to block HTTP flood attacks.
AWS WAF with rate-based rules blocks anomalous IP request rates, and AWS Shield Advanced provides automated Layer 7 protection.
Layer 7 attacks mimic real traffic, requiring application-layer analysis and rate-limiting to mitigate without blocking legitimate traffic.

Key Concept

Edge protection and DDoS mitigation for hybrid architectures
Estimated Time:2m 30s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic