Examkin

Question

Difficulty: Very hardEdge and DDoS Protection

A global telematics provider hosts an API on AWS for smart vehicles to upload telemetry data. The API is hosted on Amazon Elastic Container Service (Amazon ECS) tasks behind an Application Load Balancer (ALB). The provider is experiencing sophisticated Layer 7 HTTP flood attacks that mimic legitimate telemetry traffic, causing database resource exhaustion and high latency. Additionally, the infrastructure has been targeted by massive UDP reflection attacks at Layers 3 and 4. The provider wants to block these attacks at the AWS network edge before they reach the VPC, while ensuring minimal latency for legitimate vehicle traffic worldwide. Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and enable AWS Shield Advanced on the CloudFront distribution.Answer
  2. Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule with a custom threshold to block abusive IP addresses.Answer
  3. C
    Enable AWS Shield Standard on the Application Load Balancer, and write custom AWS WAF rules on the ALB to automatically inspect and drop Layer 3/4 UDP reflection traffic.
  4. D
    Configure the Application Load Balancer's security groups to dynamically block source IP addresses identified by AWS Shield Standard.
  5. E
    Implement stateless Network Access Control Lists (NACLs) on the subnets containing the Application Load Balancer to dynamically block traffic from UDP ports and rate-limit HTTP requests.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer with AWS Shield Advanced enabled, and associate an AWS WAF web ACL with the CloudFront distribution containing a custom rate-based rule.
To block attacks at the network edge and minimize latency, Amazon CloudFront must be deployed in front of the Application Load Balancer. CloudFront buffers and distributes traffic across AWS edge locations. Enabling AWS Shield Advanced on CloudFront provides managed Layer 3/4 DDoS protection against attacks such as UDP reflection. Additionally, associating an AWS WAF web ACL with the CloudFront distribution and configuring a rate-based rule prevents Layer 7 HTTP floods by automatically blocking IP addresses that exceed a set threshold of requests within a rolling window.

Step-by-Step Solution

1
Analyze the attack vectors and network boundary requirements.
Identify that the solution requires protecting against Layer 3/4 UDP reflection attacks and Layer 7 HTTP floods at the AWS network edge, before traffic reaches the VPC/ALB.
This establishes the need to use edge services like Amazon CloudFront rather than relying solely on VPC-level controls like ALB security groups or subnets.
2
Evaluate Edge and Layer 3/4 DDoS protection options.
Determine that deploying Amazon CloudFront automatically provides inline Layer 3/4 protection at the AWS edge. Enabling AWS Shield Advanced on the CloudFront distribution offers comprehensive protection against large-scale DDoS attacks, including UDP reflection.
CloudFront routes traffic through global Edge locations, absorbing DDoS attacks before they reach the origin, and Shield Advanced provides specialized mitigation capabilities.
3
Evaluate Layer 7 HTTP flood mitigation options.
Determine that AWS WAF associated with CloudFront is the best practice for application-layer (Layer 7) protection. Implementing a rate-based rule allows the system to track request rates per IP and temporarily block clients that exceed the configured threshold.
This directly targets HTTP floods mimicking legitimate telemetry traffic without impacting authorized clients that stay within normal usage limits.

Key Concept

Multi-layered edge security and DDoS mitigation using Amazon CloudFront, AWS Shield Advanced, and AWS WAF.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic