Examkin

Question

Difficulty: HardEdge and DDoS Protection

A smart grid utility company operates a real-time energy telemetry API on AWS. The API is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). During grid fluctuations, the API suffers from coordinated Layer 7 HTTP flood attacks disguised as legitimate smart meter reporting traffic. The legitimate meter reports always target a specific URI path and include a custom header X-Meter-Token. The security team wants to mitigate these attacks at the edge before they reach the ALB, without blocking legitimate traffic or modifying the backend application code. Which solution meets these requirements with the least operational overhead?

  1. Deploy an Amazon CloudFront distribution in front of the ALB. Associate an AWS WAF web ACL with the CloudFront distribution. Configure an AWS WAF rate-based rule that limits requests targeting the API's URI path that do not contain the expected X-Meter-Token header. Restrict the ALB to accept traffic only from the CloudFront distribution.Answer
  2. B
    Associate an AWS WAF web ACL directly with the ALB. Configure a stateless Network ACL on the public subnets that inspects incoming packets for the X-Meter-Token header and blocks traffic exceeding a specified threshold of connections per second.
  3. C
    Enable AWS Shield Standard on the Application Load Balancer. Create a security group rule on the ALB that restricts traffic rates and blocks any requests containing invalid values in the HTTP header.
  4. D
    Deploy an Amazon CloudFront distribution in front of the ALB. Configure the security groups on the backend EC2 instances to dynamically block traffic based on AWS Shield Standard alerts, and use an AWS WAF web ACL on the ALB to drop requests without the X-Meter-Token header.

Answer

Deploy Amazon CloudFront in front of the ALB, associate an AWS WAF web ACL with the CloudFront distribution, use a rate-based rule to restrict requests missing the X-Meter-Token header, and restrict the ALB to accept traffic only from CloudFront.
Deploying Amazon CloudFront in front of the Application Load Balancer (ALB) and associating it with AWS WAF protects the application at the edge of the AWS network. Configuring an AWS WAF rate-based rule matching requests that target the API path and do not contain the custom X-Meter-Token header ensures that flood traffic is blocked before hitting the origin, while legitimate meter traffic remains unaffected. Restricting the ALB to accept traffic only from CloudFront ensures that attackers cannot bypass the edge protections.

Step-by-Step Solution

1
Deploy Amazon CloudFront in front of the Application Load Balancer.
Establishes a global cache and edge networking front-end that can absorb large-scale infrastructure and application-layer traffic before it hits origin servers.
This is necessary to satisfy the security requirement of mitigating the DDoS attack at the edge of the network.
2
Create and associate an AWS WAF web ACL with the CloudFront distribution with a targeted rate-based rule.
Evaluates incoming requests at the CloudFront edge locations, applying rate-limiting specifically to traffic matching the API path that is missing the X-Meter-Token header.
This distinguishes legitimate meter traffic from the malicious HTTP flood and mitigates it automatically at the layer 7 level.
3
Restrict the ALB to only accept requests forwarded from the CloudFront distribution.
Ensures that clients cannot bypass CloudFront and AWS WAF protections by targeting the ALB public IP address directly.
To secure the origin and maintain edge-protection enforcement.

Key Concept

Deploying CloudFront with AWS WAF at the edge for Layer 7 DDoS mitigation and protecting the origin from direct access.
Estimated Time:2m 0s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic