Examkin

Question

Difficulty: HardEdge and DDoS Protection

A digital payment processing company provides a merchant API endpoint using an Application Load Balancer (ALB) backed by Amazon EC2 instances in a private subnet. The company must implement a security solution to defend against distributed denial of service (DDoS) attacks. The solution must protect the API from HTTP GET floods (Layer 7) and automatically mitigate UDP floods (Layer 3/4) before they reach the ALB. Additionally, the company requires 24/7 access to the AWS Shield Response Team (SRT) to assist in custom mitigation during active security incidents.

Which combination of AWS services and configurations should a solutions architect recommend to meet these security requirements with the least operational complexity?

  1. Deploy Amazon CloudFront in front of the ALB. Associate an AWS WAF Web ACL with the CloudFront distribution and configure a rate-based rule. Subscribe to AWS Shield Advanced and enable it on the CloudFront distribution.Answer
  2. B
    Deploy Amazon CloudFront in front of the ALB. Subscribe to AWS Shield Standard for the CloudFront distribution. Configure a custom AWS Lambda function triggered by Amazon CloudWatch Logs to dynamically add deny rules to the VPC Network Access Control Lists (NACLs) to block HTTP GET and UDP floods.
  3. C
    Associate an AWS WAF Web ACL directly with the ALB and configure a rate-based rule for HTTP GET floods. Enable AWS Shield Advanced on the ALB to mitigate UDP floods and obtain SRT access. Implement Security Group rules on the ALB to automatically drop UDP packets from untrusted CIDR blocks.
  4. D
    Subscribe to AWS Shield Advanced and enable it directly on the private EC2 instances. Configure AWS WAF on the ALB to filter the UDP floods. Set up a VPC gateway endpoint to automatically route all inbound API traffic through AWS Shield Response Team (SRT) scrubbing centers.

Answer

Deploy Amazon CloudFront in front of the ALB. Associate an AWS WAF Web ACL with the CloudFront distribution and configure a rate-based rule. Subscribe to AWS Shield Advanced and enable it on the CloudFront distribution.
The correct architecture uses Amazon CloudFront as the entry point to absorb Layer 3 and Layer 4 attacks at the AWS edge using AWS Shield Advanced. This configuration also grants 24/7 access to the AWS Shield Response Team (SRT) for active assistance. Meanwhile, AWS WAF is associated with CloudFront to inspect Layer 7 traffic and enforce rate limits on HTTP GET requests, mitigating HTTP flood attacks automatically before they reach the backend Application Load Balancer.

Step-by-Step Solution

1
Analyze the requirements for L3/4 and L7 protection along with SRT engagement.
Identified the need for Layer 3/4 protection (UDP floods), Layer 7 protection (HTTP GET floods), and AWS Shield Response Team (SRT) access.
This establishes the scope of the services needed: AWS Shield Advanced is required for SRT access, and AWS WAF is required for Layer 7 rate limiting.
2
Determine the optimal point of enforcement.
Amazon CloudFront should be deployed in front of the ALB to act as the entry point at the AWS edge.
Enforcing security at the edge (CloudFront) prevents DDoS traffic from reaching the regional resources (ALB and EC2), protecting network capacity and compute resources from exhaustion.
3
Configure Layer 3/4 and Layer 7 protection on the edge resource.
Enable AWS Shield Advanced on CloudFront to mitigate L3/4 UDP floods and gain SRT support. Associate AWS WAF with CloudFront and configure a rate-based rule to automatically block IPs exceeding HTTP GET thresholds.
This combined architecture ensures automated protection at the edge, satisfies the requirement for SRT access, and handles both application-layer and infrastructure-layer attacks with minimal operational overhead.

Key Concept

Best practices for AWS Edge Security involve combining Amazon CloudFront, AWS Shield Advanced, and AWS WAF to mitigate Layer 3, 4, and 7 DDoS attacks before traffic reaches regional infrastructure.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic