Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A global pharmaceutical company hosts a clinical trial portal on AWS. The portal consists of static media assets stored in an Amazon S3 bucket served via Amazon CloudFront, and a dynamic telemetry ingestion API hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). During a recent test, the portal was targeted by a distributed HTTP flood (Layer 7 DDoS attack) that degraded the API's performance. A solutions architect must design a secure architecture that protects both the static assets and the API from Layer 7 attacks, and ensures that the EC2 instances only accept traffic originating from CloudFront. Which combination of security controls should the solutions architect implement to meet these requirements? (Select TWO.)

  1. Associate AWS WAF with the Amazon CloudFront distribution, and configure a rate-based rule to block IP addresses that exceed a request threshold.Answer
  2. Configure the Application Load Balancer's security group to only allow traffic from the Amazon CloudFront IP ranges using the AWS-managed prefix list.Answer
  3. C
    Configure stateless Network Access Control Lists (NACLs) at the subnet level to block incoming traffic on port 80 and port 443 during an active attack.
  4. D
    Rely on AWS Shield Standard to automatically detect and block the Layer 7 HTTP flood at the Application Load Balancer.
  5. E
    Associate AWS WAF directly with the Amazon S3 bucket, and configure a Geo Match rule to block requests from unauthorized regions.

Answer

The correct combination of security controls is to associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule to block IPs exceeding a threshold, and to configure the Application Load Balancer's security group to only allow traffic from the Amazon CloudFront IP ranges using the AWS-managed prefix list.
The correct response implements a multi-layered defense. First, attaching AWS WAF to CloudFront with rate-based rules mitigates Layer 7 HTTP floods at the edge. Second, configuring the load balancer's security group to only accept traffic from CloudFront's IP ranges (using the AWS-managed prefix list) prevents attackers from bypassing CloudFront and attacking the Application Load Balancer directly.

Step-by-Step Solution

1
Protect the application layer (Layer 7) at the edge from HTTP flood attacks.
AWS WAF is associated with the Amazon CloudFront distribution, and a rate-based rule is configured to block IPs exceeding request limits.
This blocks malicious Layer 7 traffic at the CloudFront edge locations before it reaches the backend origin, mitigating resource exhaustion.
2
Prevent attackers from bypassing edge protections by attacking the origin directly.
The Application Load Balancer's security group is restricted to inbound traffic from the Amazon CloudFront AWS-managed prefix list.
This ensures that all incoming HTTP/HTTPS traffic must pass through CloudFront and AWS WAF, preventing direct attacks on the load balancer.

Key Concept

Layer 7 DDoS protection using AWS WAF rate-based rules combined with origin shielding by restricting Application Load Balancer access to CloudFront IP ranges using the AWS-managed prefix list.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic