Examkin

Question

Difficulty: MediumThreat Protection and Web Application Firewall (WAF)

A company's production e-commerce application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company has subscribed to AWS Shield Advanced to protect its infrastructure from distributed denial of service (DDoS) attacks. A SysOps administrator is tasked with configuring automatic application-layer DDoS mitigation to block traffic from sources identified by AWS Shield.

Which two configuration steps must the administrator perform to enable this automatic mitigation? (Select TWO.)

  1. Associate an AWS WAF Web ACL with the Application Load Balancer.Answer
  2. Enable automatic application-layer DDoS mitigation on the protected ALB resource within AWS Shield Advanced.Answer
  3. C
    Configure a stateless Network Access Control List (NACL) rule on the public subnets to block traffic from the threat intelligence IP set.
  4. D
    Create an Amazon EventBridge rule that detects Shield alarms and triggers an AWS Config remediation rule to deploy the Web ACL.
  5. E
    Enable Amazon CloudWatch detailed monitoring on the ALB to allow Shield Advanced to analyze application-layer traffic.

Answer

Associate an AWS WAF Web ACL with the Application Load Balancer, and enable automatic application-layer DDoS mitigation on the protected ALB resource within AWS Shield Advanced.
To protect an Application Load Balancer with AWS Shield Advanced automatic application-layer DDoS mitigation, the administrator must first ensure an AWS WAF Web ACL is associated with the ALB. The administrator must then enable the automatic mitigation option on the protected resource in Shield Advanced. When enabled, Shield Advanced automatically creates the 'ShieldMitigationRuleGroup' inside the associated Web ACL and dynamically updates rules during an event to block malicious traffic.

Step-by-Step Solution

1
Ensure the Application Load Balancer is protected by AWS Shield Advanced and associated with an AWS WAF Web ACL.
The ALB resource is configured to be monitored by Shield Advanced and has a Web ACL attached.
AWS Shield Advanced requires an associated WAF Web ACL to automatically insert and manage mitigation rules.
2
Enable the automatic application-layer DDoS mitigation setting in the AWS Shield Advanced console or via the AWS CLI for the protected ALB resource.
AWS Shield Advanced automatically creates and configures the 'ShieldMitigationRuleGroup' inside the associated Web ACL.
This allows AWS Shield to dynamically add WAF rules to block traffic from identified DDoS sources in response to an ongoing attack.

Key Concept

AWS Shield Advanced Automatic Application-Layer DDoS Mitigation
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic