Examkin

Question

Difficulty: Very hardEdge and DDoS Protection

A global healthcare SaaS provider hosts its telemedicine platform on AWS. The architecture consists of an Amazon CloudFront distribution caching static web content, an Application Load Balancer (ALB), and an Amazon ECS cluster running containerized microservices on AWS Fargate. During a high-profile launch, the platform experiences a distributed denial of service (DDoS) attack consisting of a massive Layer 3/4 UDP reflection attack, a Layer 7 HTTP GET flood targeting the patient search API endpoint, and concurrent SQL injection attempts on the database through the search parameters. The provider needs to implement a solution that automatically detects and mitigates the Layer 3/4 volumetric attacks at the network edge, identifies and blocks the SQL injection attempts and the Layer 7 HTTP GET flood before they reach the ECS cluster, protects the organization from unexpected billing spikes caused by the scale-up of resources during the attack, and prevents attackers from bypassing CloudFront and targeting the ALB directly. Which combination of configurations should the solutions architect implement to meet these requirements?

  1. A
    Subscribe to AWS Shield Advanced and associate it with the ECS Fargate service. Configure stateless Network ACLs in the public subnets to block the IP addresses associated with the Layer 3/4 UDP reflection and the Layer 7 HTTP GET flood. Deploy AWS WAF on the ALB to inspect and block SQL injection attempts.
  2. Subscribe to AWS Shield Advanced and associate it with both the CloudFront distribution and the ALB. Deploy AWS WAF on the CloudFront distribution with a rate-based rule for the search endpoint and a SQL injection inspection rule. Configure the ALB security group to allow inbound traffic only from the CloudFront managed prefix list, and restrict the ECS security group to allow traffic only from the ALB.Answer
  3. C
    Deploy AWS WAF on the CloudFront distribution with a rate-based rule and SQL injection inspection rules. Configure the ALB listener rules to allow traffic only when a custom HTTP header shared with CloudFront is present. Rely on AWS Shield Standard to automatically mitigate Layer 3/4 attacks and provide financial protection against scaling charges incurred by the ALB and ECS cluster.
  4. D
    Deploy AWS WAF on the CloudFront distribution and associate it with an AWS Shield Standard protection group. Create a security group for the ALB that allows inbound traffic only from the public IP ranges of AWS WAF. Implement rate-limiting at the ECS container level using application-specific middleware.

Answer

Subscribe to AWS Shield Advanced and associate it with both the CloudFront distribution and the ALB. Deploy AWS WAF on the CloudFront distribution with a rate-based rule for the search endpoint and a SQL injection inspection rule. Configure the ALB security group to allow inbound traffic only from the CloudFront managed prefix list, and restrict the ECS security group to allow traffic only from the ALB.
Subscribing to AWS Shield Advanced and protecting both Amazon CloudFront and the Application Load Balancer (ALB) provides automatic Layer 3/4 protection and cost protection for scaling charges of these resources. Applying AWS WAF rules at the CloudFront distribution allows Layer 7 rate-limiting and SQL injection protection to happen at the edge, blocking malicious requests before they reach the backend. Restricting the ALB security group to the CloudFront managed prefix list prevents attackers from bypassing the CDN to attack the load balancer directly, and restricting the ECS security group to allow traffic only from the ALB ensures proper multi-tier isolation.

Step-by-Step Solution

1
Select AWS Shield Advanced and associate it with the CloudFront distribution and the Application Load Balancer (ALB).
Establishes automatic mitigation of Layer 3/4 volumetric attacks at the edge and activates DDoS cost protection, allowing the company to request credits for scaling charges on the protected ALB and CloudFront resources.
AWS Shield Standard does not offer cost protection or advanced mitigation for scaling charges.
2
Deploy AWS WAF on the Amazon CloudFront distribution and configure rate-based rules alongside SQL injection detection rules.
Inspects and filters Layer 7 traffic at the CloudFront edge locations, blocking SQL injection attempts and rate-limiting the HTTP GET flood before they reach the ALB or the ECS Fargate containers.
Blocking malicious requests at the edge prevents backend resources from scaling up unnecessarily, saving costs and protecting performance.
3
Configure the ALB security group to restrict inbound traffic to the CloudFront managed prefix list.
Ensures that all incoming traffic to the ALB must originate from CloudFront, preventing attackers from bypassing CloudFront and hitting the load balancer directly.
Direct hits to the ALB bypass the AWS WAF rules and Shield Advanced protections configured on CloudFront.

Key Concept

Edge security design combining AWS Shield Advanced for L3/L4 volumetric protection and cost protection, AWS WAF for L7 application-layer filtering and rate-limiting, and CloudFront managed prefix lists to prevent origin bypass.
Estimated Time:3m 0s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic