Examkin

Question

Difficulty: MediumEdge and DDoS Protection

A global financial services company is deploying a real-time trading API on AWS. The API must be deployed across multiple AWS Regions to ensure low latency for users worldwide. The architecture uses Application Load Balancers (ALBs) in each Region to distribute traffic to Amazon EC2 instances. The company needs a secure edge routing solution that provides static IP addresses, routes traffic over the AWS global network, protects against Layer 3 and Layer 4 DDoS attacks, and mitigates Layer 7 HTTP flood attacks.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create an accelerator using AWS Global Accelerator, register the Application Load Balancers in each Region as endpoints, and enable AWS Shield Advanced on the accelerator.Answer
  2. Associate an AWS WAF web ACL containing a rate-based rule with the Application Load Balancer in each Region.Answer
  3. C
    Associate an AWS WAF web ACL directly with the AWS Global Accelerator to inspect and block Layer 7 HTTP flood attacks.
  4. D
    Configure stateless Network Access Control Lists (NACLs) at the subnet level to dynamically detect and drop traffic from IP addresses initiating Layer 7 HTTP flood attacks.
  5. E
    Configure AWS Shield Standard to monitor security groups and automatically add inbound deny rules for offending IP addresses.

Answer

To meet the requirements, the solutions architect should create an accelerator using AWS Global Accelerator, register the Application Load Balancers in each Region as endpoints, enable AWS Shield Advanced on the accelerator, and associate an AWS WAF web ACL containing a rate-based rule with the Application Load Balancer in each Region.
The correct actions are to deploy AWS Global Accelerator with AWS Shield Advanced enabled and to associate AWS WAF web ACLs with the Application Load Balancers. AWS Global Accelerator provides static IP addresses and routes traffic over the AWS global network to endpoints (such as ALBs) in multiple Regions, and Shield Advanced can be applied to the accelerator to defend against Layer 3 and Layer 4 DDoS attacks. To protect against Layer 7 HTTP flood attacks, AWS WAF web ACLs with rate-based rules must be associated with the regional ALBs.

Step-by-Step Solution

1
Identify the routing and network-layer protection requirements.
Determine that AWS Global Accelerator satisfies the requirement for multi-region routing with static IP addresses over the AWS global backbone. AWS Shield Advanced is then enabled on the accelerator to defend against Layer 3 and Layer 4 DDoS attacks.
This establishes a secure, low-latency entry point into the AWS network while protecting the infrastructure layer.
2
Identify the application-layer (Layer 7) protection requirements.
Determine that AWS WAF web ACLs with rate-based rules must be associated with the Application Load Balancers in each Region.
This inspects application traffic at the load balancing tier and mitigates HTTP flood attacks before they impact the backend EC2 instances.

Key Concept

Integrating AWS Global Accelerator, AWS Shield Advanced, and AWS WAF to secure multi-region web applications at both the infrastructure (Layer 3/4) and application (Layer 7) layers.
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic