Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

A company hosts a dynamic web application on Amazon EC2 instances behind Application Load Balancers (ALBs) in the us-west-2 and eu-west-1 Regions. The application is accessed by users globally. The company wants to improve application performance by minimizing transit path latency, packet loss, and jitter. Additionally, they must implement stateless network filtering to block a list of known malicious IP ranges at the subnet boundary before the traffic reaches the ALBs.

Which two options should the solutions architect choose to meet these requirements?

  1. Deploy AWS Global Accelerator and register the ALBs in both Regions as endpoints.Answer
  2. Configure Network ACLs on the subnets where the ALBs are deployed with deny rules for the malicious IP ranges.Answer
  3. C
    Create Amazon Route 53 records with latency-based routing policies that point directly to the ALB in each Region.
  4. D
    Add inbound rules to the ALB security groups to explicitly deny traffic from the malicious IP ranges.
  5. E
    Establish a single AWS Site-to-Site VPN connection from the users' networks to the VPCs to route the application traffic.

Answer

Deploying AWS Global Accelerator to route traffic over the AWS backbone network and configuring Network ACLs on the ALB subnets to statelessly block malicious IP ranges.
The combination of deploying AWS Global Accelerator and configuring Network ACLs meets all constraints. AWS Global Accelerator improves application performance for global users by routing traffic over the optimized AWS global backbone, which minimizes latency, jitter, and packet loss. Network ACLs provide stateless network filtering at the subnet boundary, allowing the solutions architect to create deny rules to block the specified malicious IP ranges before the traffic reaches the Application Load Balancers.

Step-by-Step Solution

1
Evaluate routing solutions for performance optimization.
AWS Global Accelerator is selected because it uses anycast IP routing over the congestion-free AWS private network to minimize packet loss, jitter, and latency compared to public internet routing.
Users globally access the application, and the public internet path introduces higher jitter and latency variance.
2
Evaluate traffic filtering requirements at the subnet boundary.
Network ACLs are selected because they operate at the subnet boundary and allow stateless deny rules.
The requirement calls for stateless filtering before traffic reaches the ALBs, which Security Groups cannot provide as they are stateful and allow-only.

Key Concept

Combining AWS Global Accelerator for optimized global routing with Network ACLs for stateless edge subnet security filtering.
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic