Examkin

Question

Difficulty: MediumEdge and DDoS Protection

An e-learning company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application needs protection from SQL injection attacks and volumetric Layer 3 and Layer 4 DDoS attacks. The company wants a solution that requires minimal operational overhead and integrates with their current architecture.

Which solution should a solutions architect recommend to meet these requirements?

  1. Deploy Amazon CloudFront in front of the Application Load Balancer, associate AWS WAF with the CloudFront distribution to block SQL injection using managed rules, and rely on AWS Shield Standard for automatic Layer 3 and Layer 4 DDoS protection.Answer
  2. B
    Enable AWS Shield Standard on the Application Load Balancer and configure custom rules within Shield to parse HTTP payloads and block SQL injection requests.
  3. C
    Configure the subnet Network ACLs (NACLs) to perform deep packet inspection to block SQL injection patterns, and configure the EC2 Security Groups to automatically rate-limit Layer 3 and Layer 4 traffic.
  4. D
    Deploy Amazon CloudFront in front of the Application Load Balancer, and configure the CloudFront distribution's Origin Access Control (OAC) to inspect incoming HTTP requests and drop SQL injection attacks.

Answer

Deploy Amazon CloudFront in front of the Application Load Balancer, associate AWS WAF with the CloudFront distribution to block SQL injection using managed rules, and rely on AWS Shield Standard for automatic Layer 3 and Layer 4 DDoS protection.
Deploying Amazon CloudFront with an associated AWS WAF web ACL uses managed rules to inspect HTTP payloads at the edge and mitigate Layer 7 SQL injection attacks. AWS Shield Standard, which is automatically active for CloudFront, provides Layer 3 and Layer 4 DDoS protection with zero configuration or additional cost.

Step-by-Step Solution

1
Analyze security requirements at different network layers.
Identify that SQL injection is a Layer 7 application exploit, whereas volumetric DDoS attacks target Layers 3 and 4.
Choosing the correct security tools requires mapping the threat type to the OSI model layer.
2
Select the appropriate services to inspect application traffic and mitigate DDoS.
AWS WAF provides Layer 7 payload inspection, and AWS Shield Standard provides automatic Layer 3/4 protection at the edge when integrated with Amazon CloudFront.
AWS WAF handles web application firewall duties, and AWS Shield Standard handles edge DDoS mitigation, providing a complete security posture.
3
Integrate the edge security components with the load-balanced application.
Deploy Amazon CloudFront as the entry point in front of the Application Load Balancer, then attach AWS WAF to the CloudFront distribution.
Moving threat mitigation to the edge with CloudFront reduces load on origin EC2 instances and mitigates attacks before they reach the VPC.

Key Concept

Edge security and DDoS protection using AWS Shield and AWS WAF
Estimated Time:1m 30s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic