Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A logistics company hosts a shipment tracking portal on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The portal has recently experienced HTTP flood attacks targeting the search endpoint, which overloads the ALB and causes application downtime. A solutions architect must design a secure architecture that mitigates these Layer 7 DDoS attacks at the AWS edge network before they reach the ALB.

Which solution meets these requirements?

  1. Deploy an Amazon CloudFront distribution in front of the ALB. Create an AWS WAF web ACL with a rate-based rule and associate it with the CloudFront distribution.Answer
  2. B
    Rely on AWS Shield Standard enabled on the ALB to automatically detect and block the Layer 7 HTTP flood attacks.
  3. C
    Configure the security group attached to the ALB to dynamically detect and block the IP addresses sending the HTTP flood traffic.
  4. D
    Create stateless network access control lists (NACLs) on the subnets of the ALB to rate-limit requests from the attacking IP addresses.

Answer

Deploy an Amazon CloudFront distribution in front of the ALB. Create an AWS WAF web ACL with a rate-based rule and associate it with the CloudFront distribution.
The correct option is to deploy Amazon CloudFront in front of the ALB and associate it with an AWS WAF web ACL configured with a rate-based rule. AWS WAF rate-based rules track the number of requests from each originating IP address and block requests that exceed a defined threshold. Deploying this at the CloudFront distribution leverages the AWS edge network, stopping the DDoS traffic before it reaches the backend infrastructure.

Step-by-Step Solution

1
Shift the application entry point to the AWS edge network by deploying Amazon CloudFront.
Inbound user traffic is routed through AWS edge locations rather than directly hitting the ALB.
This establishes an edge protection layer and absorbs traffic closer to the users.
2
Create an AWS WAF web ACL with a rate-based rule.
A security rule is established that tracks the rate of requests from individual IP addresses over a rolling 5-minute period.
Rate-limiting is the standard mechanism to mitigate HTTP flood attacks at the application layer.
3
Associate the AWS WAF web ACL with the CloudFront distribution.
Excessive requests are blocked at the edge network, ensuring only legitimate traffic is forwarded to the ALB.
This prevents malicious Layer 7 traffic from consuming ALB resources or reaching the EC2 origin servers.

Key Concept

Mitigating Layer 7 DDoS attacks at the edge using Amazon CloudFront and AWS WAF rate-based rules.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic