Examkin

Question

Difficulty: HardEdge and DDoS Protection

A global logistics company hosts its shipment-tracking application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent downtime due to sophisticated Layer 7 HTTP flood attacks originating from a distributed botnet. The company needs to implement a solution that mitigates these HTTP floods at the network edge, minimizes latency for global users, and prevents unauthorized requests from bypassing the edge security controls.

Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.Answer
  2. Configure the Application Load Balancer's security group to restrict inbound traffic to only the Amazon CloudFront IP ranges using the AWS-managed prefix list.Answer
  3. C
    Enable AWS Shield Standard on the Application Load Balancer to automatically detect and block the Layer 7 HTTP flood attacks.
  4. D
    Configure stateless Network Access Control Lists (NACLs) on the Application Load Balancer subnets to dynamically block the attacking IP addresses.
  5. E
    Modify the Application Load Balancer security group rules to rate-limit connections and block malicious payloads at the VPC border.

Answer

Deploying an Amazon CloudFront distribution with an AWS WAF web ACL rate-based rule, and restricting the Application Load Balancer security group to CloudFront IP addresses using the AWS-managed prefix list.
To protect the application from Layer 7 HTTP floods at the edge and minimize latency, deploying Amazon CloudFront and associating an AWS WAF web ACL with a rate-based rule is the recommended AWS best practice. The rate-based rule monitors client requests and automatically blocks IPs that exceed the set threshold. Furthermore, to prevent attackers from bypassing these edge controls and attacking the backend directly, the Application Load Balancer's security group must be locked down to only allow inbound traffic from the CloudFront IP ranges, which is easily managed using the AWS-managed prefix list.

Step-by-Step Solution

1
Analyze the attack vector and mitigation point.
The attack is a Layer 7 HTTP flood. The requirement is to mitigate this at the network edge and minimize latency for global users.
Layer 7 attacks must be mitigated using application-aware firewalls. Edge services like Amazon CloudFront and AWS WAF are best suited to inspect and block traffic globally before it reaches the backend.
2
Select edge security components.
Deploy Amazon CloudFront to cache content and reduce latency, and associate an AWS WAF web ACL with a rate-based rule to automatically block HTTP floods.
AWS WAF rate-based rules track the request rate from client IP addresses and temporarily block IPs that exceed the threshold, protecting against distributed L7 attacks at the edge.
3
Secure the origin backend.
Restrict access to the Application Load Balancer by configuring its security group to only allow traffic from CloudFront.
If the Application Load Balancer is publicly accessible, attackers can bypass CloudFront and AWS WAF entirely. Restricting the ALB security group using the AWS-managed prefix list for CloudFront ensures all traffic is forced through the edge security layer.

Key Concept

Mitigating Layer 7 HTTP flood attacks at the edge using CloudFront and AWS WAF, and securing the backend origin ALB from direct access.
Estimated Time:2m 0s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic