Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A software-as-a-service (SaaS) provider hosts its API on Amazon EC2 instances behind an Application Load Balancer (ALB). The API has been experiencing recurring Layer 7 HTTP flood attacks, causing resource exhaustion on the EC2 instances. The provider wants to mitigate these attacks at the AWS network edge before they reach the ALB, without blocking legitimate client requests.

Which solution should a solutions architect recommend?

  1. Create an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.Answer
  2. B
    Rely on AWS Shield Standard, which is enabled by default on the Application Load Balancer, to automatically inspect and block the Layer 7 HTTP flood attacks.
  3. C
    Configure stateless Network Access Control Lists (NACLs) on the ALB subnets to automatically track connection states and block the HTTP flood traffic.
  4. D
    Update the security groups associated with the EC2 instances to dynamically block the source IP addresses of the HTTP flood attacks at the subnet boundary.

Answer

Create an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.
Associating an AWS WAF web ACL with an Amazon CloudFront distribution allows the rate-limiting and filtering of Layer 7 HTTP flood attacks at AWS edge locations, preventing the traffic from reaching the Application Load Balancer and the backend EC2 instances.

Step-by-Step Solution

1
Identify the OSI layer of the attack.
The attacks are Layer 7 HTTP floods, which target the application layer.
Choosing the right defense requires understanding whether the attack is at the infrastructure layer (Layer 3/4) or the application layer (Layer 7).
2
Determine the appropriate AWS security services for Layer 7 mitigation.
AWS WAF is designed to inspect and filter Layer 7 traffic, while AWS Shield Standard only covers Layer 3/4.
AWS WAF rate-based rules are required to automatically identify and block clients exceeding a reasonable request threshold.
3
Deploy the protection at the network edge.
Position Amazon CloudFront in front of the Application Load Balancer, and associate the AWS WAF web ACL with the CloudFront distribution.
Placing CloudFront and AWS WAF at the edge ensures that malicious traffic is dropped before it consumes bandwidth or resources at the Application Load Balancer.

Key Concept

Mitigating Layer 7 DDoS attacks at the edge using Amazon CloudFront and AWS WAF rate-based rules.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic