Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A financial technology company hosts a payment gateway API on Amazon ECS container instances behind an Application Load Balancer (ALB). The API has recently been targeted by distributed denial of service (DDoS) attacks, including Layer 7 HTTP floods that consume ECS container resources and volumetric Layer 3/4 attacks that saturate network bandwidth. The company needs to implement a highly resilient edge security solution to mitigate these attacks before they reach the origin.

Which combination of actions should the company take to meet these requirements? (Select TWO.)

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB) and associate an AWS WAF web ACL containing a rate-based rule.Answer
  2. Enable AWS Shield Advanced on the Amazon CloudFront distribution to protect the entry point against volumetric Layer 3 and Layer 4 attacks.Answer
  3. C
    Configure Network Access Control Lists (NACLs) on the subnets hosting the container instances to automatically block Layer 7 HTTP flood patterns.
  4. D
    Configure the security groups of the Application Load Balancer (ALB) to allow traffic only from a list of IP addresses manually updated by AWS Shield Standard.
  5. E
    Enable AWS Shield Standard on the container instances to automatically identify and block Layer 7 exploits like SQL injection.

Answer

Deploying an Amazon CloudFront distribution with an associated AWS WAF web ACL containing a rate-based rule, and enabling AWS Shield Advanced on the CloudFront distribution.
To mitigate both Layer 7 HTTP floods and Layer 3/4 volumetric DDoS attacks, the architecture should leverage Amazon CloudFront as the entry point. Associating AWS WAF with CloudFront allows the use of rate-based rules to detect and block clients sending unusually high volumes of HTTP requests at the edge, protecting ECS container resources from exhaustion. Enabling AWS Shield Advanced on the CloudFront distribution provides advanced DDoS protection against volumetric attacks targeting the infrastructure layers, along with access to the AWS Shield Response Team (SRT).

Step-by-Step Solution

1
Analyze the attack vectors affecting the payment gateway API.
Identified Layer 7 HTTP floods (requiring application-layer filtering) and volumetric Layer 3/4 attacks (requiring infrastructure-layer mitigation).
Edge protection must address different layers of the OSI model using appropriate security services.
2
Design Layer 7 mitigation at the network edge.
Place Amazon CloudFront in front of the Application Load Balancer and attach AWS WAF with rate-based rules.
CloudFront acts as the entry point at edge locations, and AWS WAF evaluates and blocks HTTP floods before they reach the ALB and ECS container instances.
3
Design Layer 3/4 volumetric protection.
Enable AWS Shield Advanced on the Amazon CloudFront distribution.
AWS Shield Advanced offers tailored mitigation and protection against volumetric DDoS attacks at the AWS edge network.

Key Concept

AWS Edge Security and DDoS Mitigation using CloudFront, WAF, and Shield
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic