Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise operates a web application deployed on Amazon ECS tasks running on AWS Fargate in private subnets, fronted by an internet-facing Application Load Balancer (ALB). The application requires users to authenticate via SAML 2.0 with an external corporate identity provider (IdP). To improve security, the organization wants to offload the authentication process from the application layer to the ALB. Additionally, the application must be protected against SQL injection attacks and brute-force traffic spikes. Which of the following actions should the solutions architect take to meet these requirements? (Select two.)

  1. Configure the Application Load Balancer HTTPS listener to authenticate users using an authenticate-oidc action integrated with an Amazon Cognito user pool that is federated with the external identity provider.Answer
  2. Associate an AWS WAF web ACL with the Application Load Balancer, and configure rate-limiting and SQL injection mitigation rules, ensuring they are placed at higher priority and evaluated before the default action.Answer
  3. C
    Associate an AWS WAF web ACL with the Application Load Balancer, and configure a default allow rule at priority 0, followed by rate-limiting and SQL injection block rules at lower priority to minimize processing overhead.
  4. D
    Configure the Application Load Balancer HTTPS listener to forward traffic to the tasks, and configure the Fargate execution role to trust the external identity provider using a trust policy with the sts:AssumeRole action.
  5. E
    Deploy a Route 53 Resolver endpoint and associate a Private Hosted Zone containing the portal records with a shared services VPC, without associating it with the Fargate VPC.

Answer

The solutions architect should configure the Application Load Balancer HTTPS listener to authenticate users using an authenticate-oidc action integrated with an Amazon Cognito user pool, and associate an AWS WAF web ACL configured with rate-limiting and SQL injection rules evaluated at high priority.
Configuring the Application Load Balancer HTTPS listener to use the authenticate-oidc action with Amazon Cognito simplifies application logic by offloading authentication to the load balancer tier. Associating AWS WAF with the ALB and ordering SQL injection and rate-limiting rules at a higher priority ensures malicious requests are blocked before they are routed to the backend tasks.

Step-by-Step Solution

1
Determine the method for offloading user authentication to the load balancer tier.
Using the authenticate-oidc listener rule action on the Application Load Balancer linked to Amazon Cognito integrates with the external identity provider.
Allows authentication to occur at the network edge, relieving the backend container tasks of handling SAML token parsing.
2
Identify the threat protection mechanism and the correct rule configuration.
AWS WAF needs to be associated with the Application Load Balancer with SQL injection and rate-limiting rules.
Secures the application against malicious traffic and brute-force scraping attempts.
3
Analyze rule priority within the AWS WAF WebACL.
Configure blocking rules at higher priorities (lower numerical values) than any catch-all allow rule or default action.
Ensures that malicious traffic is matched and blocked before rule evaluation is terminated by an allow action.

Key Concept

Continuous security improvement by offloading authentication to the ALB with Cognito and placing blocking WebACL rules at high priority in AWS WAF.
Estimated Time:2m 0s
Rate this question

Topics

Strengthening Identity, Access, and Network Security