Examkin

Soru

Zorluk: OrtaEdge and DDoS Protection

A global smart home IoT provider receives telemetry data from millions of connected devices. The ingestion endpoint is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, the ingestion endpoint experienced a sudden influx of malicious Layer 4 TCP SYN flood attacks, along with a distributed Layer 7 HTTP POST flood attack that simulates device telemetry uploads. The provider needs a solution that automatically mitigates the infrastructure-layer attacks and allows them to rate-limit and filter the malicious HTTP POST requests. Which solution meets these requirements with the least administrative effort?

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB). Associate an AWS WAF Web ACL with the CloudFront distribution, and configure a rate-based rule targeting the HTTP POST telemetry endpoint.Cevap
  2. B
    Configure stateless Network Access Control Lists (NACLs) at the subnet level to dynamically block the TCP SYN flood attacks, and apply Security Groups to rate-limit the Layer 7 HTTP POST requests.
  3. C
    Subscribe to AWS Shield Standard on the Application Load Balancer (ALB) and configure it to automatically block the Layer 7 HTTP POST flood attacks using deep packet inspection.
  4. D
    Enable AWS Shield Advanced on the Application Load Balancer (ALB) to handle the Layer 3/4 attacks, and use AWS Shield Standard to define custom URI-matching rules that block the malicious HTTP POST requests.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB). Associate an AWS WAF Web ACL with the CloudFront distribution, and configure a rate-based rule targeting the HTTP POST telemetry endpoint.
The correct solution uses Amazon CloudFront to absorb Layer 3/4 TCP SYN flood attacks at the edge locations using AWS Shield Standard. It then attaches AWS WAF to the CloudFront distribution to inspect Layer 7 traffic and enforce rate-limiting rules on HTTP POST requests, protecting the origin ALB and EC2 instances from resource exhaustion.

Adım Adım Çözüm

1
Analyze the attack vectors targeting the IoT provider's endpoints.
Identified a Layer 4 TCP SYN flood (infrastructure layer) and a Layer 7 HTTP POST flood (application layer).
Different layers of the OSI model require different mitigation strategies under the AWS Shared Responsibility Model.
2
Address the Layer 4 infrastructure attacks at the network edge.
Place Amazon CloudFront in front of the Application Load Balancer (ALB) to leverage AWS Shield Standard.
CloudFront locations absorb Layer 3 and 4 attacks automatically, keeping the load from reaching the origin ALB.
3
Mitigate the Layer 7 HTTP POST flood attacks.
Associate AWS WAF with CloudFront and configure a rate-based rule targeting the POST endpoint.
AWS WAF inspects application-layer HTTP requests and applies rate-limiting rules to block IP addresses exceeding the defined threshold.

Anahtar Kavram

AWS Edge services (Amazon CloudFront and AWS Shield Standard) automatically mitigate Layer 3/4 infrastructure attacks, while AWS WAF provides Layer 7 application-layer filtering and rate-limiting.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Edge and DDoS Protection

Bu konudan daha fazla soru