Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A municipal utility company hosts a public portal on AWS for customers to view real-time energy usage and pay bills. The application runs on EC2 instances behind an Application Load Balancer (ALB) in a single AWS Region. The portal has recently experienced service outages due to sudden HTTP flood attacks targeting the login endpoint. The company needs to implement a cost-effective, automated edge security solution that mitigates these Layer 7 attacks before they reach the ALB, while minimizing latency for legitimate local users.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer.Answer
  2. Associate an AWS WAF web ACL with the CloudFront distribution and configure a rate-based rule to limit requests to the login endpoint.Answer
  3. C
    Enable AWS Shield Standard on the Application Load Balancer to automatically block Layer 7 HTTP flood attacks.
  4. D
    Configure a stateless network ACL on the subnets containing the Application Load Balancer to block traffic from the attacker IP addresses.
  5. E
    Create a security group for the Application Load Balancer and enable rate-limiting rules to restrict concurrent TCP connections.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer and associate an AWS WAF web ACL with the distribution to configure a rate-based rule to limit requests to the login endpoint.
Deploying Amazon CloudFront moves the entry point of the application to the AWS global edge network, which naturally absorbs Layer 3 and Layer 4 DDoS attacks. Associating AWS WAF with CloudFront allows the solutions architect to inspect Layer 7 HTTP requests and apply a rate-based rule to automatically block IP addresses that exceed a specified threshold of requests to the login endpoint. This provides automated, cost-effective Layer 7 protection before the malicious traffic can reach the Application Load Balancer or the backend compute resources.

Step-by-Step Solution

1
Analyze the attack pattern and application entry point.
The attack is a Layer 7 HTTP flood targeting a specific endpoint (the login page) of an ALB-backed application.
Identifying the target and type of attack ensures the mitigation is applied at the correct layer of the OSI model.
2
Introduce an edge network layer using Amazon CloudFront.
CloudFront acts as the public entry point, caching static content and distributing the threat surface globally across AWS edge locations.
Moving the endpoint to the edge prevents direct HTTP attacks from reaching the ALB and backend EC2 instances.
3
Implement Layer 7 filtering using AWS WAF and configure rate-based rules.
An AWS WAF web ACL is associated with the CloudFront distribution, containing a rate-based rule that tracks requests from client IP addresses and blocks them if they exceed a configured threshold.
This automatically detects and mitigates HTTP flood attacks targeting the login endpoint in real time without administrative overhead.

Key Concept

Edge protection and Layer 7 DDoS mitigation using Amazon CloudFront and AWS WAF rate-based rules.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic