Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A global food delivery marketplace hosts its customer-facing application on AWS. The architecture uses an Amazon CloudFront distribution to serve static and dynamic content, which is backed by an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group. The company needs to protect the application from Layer 3 and Layer 4 Distributed Denial of Service (DDoS) attacks and mitigate application-layer (Layer 7) HTTP flood attacks that target the API endpoints. Which combination of actions will meet these requirements? (Select TWO.)

  1. Associate an AWS WAF web ACL with the Amazon CloudFront distribution and configure a rate-based rule to limit requests from individual client IP addresses.Answer
  2. Enable AWS Shield Advanced on the Amazon CloudFront distribution to protect against Layer 3 and Layer 4 infrastructure-level attacks.Answer
  3. C
    Configure custom rate-limiting rules within AWS Shield Standard to inspect incoming request headers and block HTTP flood attacks.
  4. D
    Deploy a stateless Network Access Control List (Network ACL) on the subnets containing the Application Load Balancer to dynamically inspect and block malicious Layer 7 HTTP request headers.
  5. E
    Attach a stateful security group to the Amazon CloudFront distribution that blocks all traffic except from known malicious IP addresses.

Answer

Associate an AWS WAF web ACL with the Amazon CloudFront distribution and configure a rate-based rule to limit requests from individual client IP addresses, and enable AWS Shield Advanced on the Amazon CloudFront distribution to protect against Layer 3 and Layer 4 infrastructure-level attacks.
The solution requires protecting the application at both the infrastructure (Layer 3/4) and application (Layer 7) levels. Associating an AWS WAF web ACL with the Amazon CloudFront distribution and configuring a rate-based rule successfully mitigates HTTP floods by counting requests from specific client IP addresses and blocking them if they exceed limits. Enabling AWS Shield Advanced on the CloudFront distribution provides specialized protection against infrastructure-level (Layer 3 and 4) DDoS attacks at the AWS edge.

Step-by-Step Solution

1
Analyze the threat types and required defense layers.
Identified Layer 3/4 infrastructure DDoS threats and Layer 7 application-level HTTP flood threats targeting dynamic APIs.
This determines which security services are appropriate for each threat vector.
2
Select the edge services designed for application-layer (Layer 7) filtering and rate limiting.
Selected AWS WAF associated with CloudFront to enforce rate-limiting rules.
AWS WAF is designed to inspect Layer 7 traffic and enforce rate limits, whereas lower-layer tools cannot parse HTTP headers or track request rates.
3
Select the service for Layer 3/4 infrastructure-level DDoS mitigation.
Selected AWS Shield Advanced on the CloudFront distribution.
AWS Shield Advanced offers robust Layer 3/4 protection at the AWS edge network (CloudFront) and provides advanced mitigation capabilities.

Key Concept

AWS edge security architecture relies on combining AWS WAF for application-layer filtering/rate-limiting and AWS Shield Advanced for comprehensive infrastructure DDoS protection.
Estimated Time:2m 0s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic