Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise has a web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is fronted by an Amazon CloudFront distribution. A security audit recommends strengthening the network and application-layer security by preventing common SQL injection attacks, rate-limiting aggressive clients at the edge, and restricting direct public internet access to the ALB so that it only processes requests originating from the CloudFront distribution. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Configure the CloudFront distribution to insert a custom HTTP header into all origin requests. Configure the ALB listener rules to forward traffic to the target group only when this header is present with the correct value, and return an HTTP 403 response for all other requests.Answer
  2. Associate an AWS WAF Web ACL with the CloudFront distribution. Configure the Web ACL with SQL injection detection rules and a rate-based rule to restrict high-volume clients, evaluating these rules before the default action.Answer
  3. C
    Associate an AWS WAF Web ACL with the ALB. Add a rule to allow all traffic at a high priority, and place the SQL injection detection and rate-limiting block rules at a lower priority.
  4. D
    Attach a Service Control Policy (SCP) to the member account that restricts ingress traffic on the ALB security group to allow only CloudFront managed prefix lists.
  5. E
    Create a Route 53 Private Hosted Zone for the application's domain name, configure an alias record pointing to the ALB, and do not associate the hosted zone with any VPC to isolate resolver queries.

Answer

Configure the CloudFront distribution to insert a custom HTTP header into origin requests, configure the ALB to only forward requests matching that header, and associate an AWS WAF Web ACL with CloudFront containing SQL injection and rate-limiting rules.
The correct combination involves inserting a custom HTTP header in CloudFront origin requests and validating this header on the ALB listener rules to restrict direct access to the ALB. Additionally, deploying AWS WAF at the CloudFront distribution enables filtering of SQL injection attacks and rate-limiting at the edge before the requests reach the application origin.

Step-by-Step Solution

1
Configure origin request custom headers in Amazon CloudFront.
CloudFront automatically appends a custom header (e.g., X-Verify-Origin) with a secret value to every request forwarded to the ALB.
This establishes a shared secret between CloudFront and the Application Load Balancer to prove the request's origin.
2
Modify the Application Load Balancer listener rules.
The ALB evaluates incoming requests, forwards matching headers to the target group, and rejects others with an HTTP 403 response.
This restricts traffic to the ALB, preventing clients from bypassing edge security controls and accessing the ALB directly.
3
Deploy and associate AWS WAF with CloudFront.
Web exploits such as SQL injection and high-rate client requests are blocked at the edge before reaching the AWS infrastructure.
This leverages edge locations to drop malicious traffic, minimizing resource consumption on the ALB and target instances.

Key Concept

Strengthening identity, access, and network security by restricting ALB access to CloudFront and applying application-layer firewalls at the edge.
Rate this question

Topics

Strengthening Identity, Access, and Network Security