Examkin

Soru

Zorluk: KolayEdge and DDoS Protection

A company is deploying a new web application on AWS using Amazon CloudFront and an Application Load Balancer. The company needs to design a security strategy that protects the application against two specific threats: common application-layer exploits such as SQL injection, and volumetric Layer 3 and Layer 4 DDoS attacks.

Which combination of AWS services should the solutions architect implement to address these threats? (Select TWO.)

  1. AWS WAF to inspect incoming HTTP/HTTPS requests and block SQL injection patterns.Cevap
  2. AWS Shield Standard to provide automatic, always-on protection against Layer 3 and Layer 4 DDoS attacks.Cevap
  3. C
    AWS Shield Standard to analyze application-layer traffic and automatically block SQL injection exploits.
  4. D
    Network Access Control Lists (NACLs) configured at the subnet level to inspect and block SQL injection payloads.
  5. E
    Security Groups applied to the Application Load Balancer to perform deep packet inspection and filter SQL injection attacks.

Cevap

AWS WAF to inspect incoming HTTP/HTTPS requests and block SQL injection patterns, and AWS Shield Standard to provide automatic, always-on protection against Layer 3 and Layer 4 DDoS attacks.
The solution requires addressing both Layer 7 exploits (like SQL injection) and Layer 3/4 DDoS attacks. AWS WAF provides Layer 7 protection by inspecting HTTP/HTTPS traffic to filter out SQL injection patterns. AWS Shield Standard automatically provides Layer 3 and Layer 4 protection against common infrastructure-layer DDoS attacks at the edge.

Adım Adım Çözüm

1
Identify the application-layer (Layer 7) security requirement.
SQL injection is a Layer 7 exploit that requires HTTP/HTTPS payload inspection to detect and block malicious patterns.
AWS WAF is the service that inspects Layer 7 web traffic and applies rules to filter out exploits like SQL injection.
2
Identify the infrastructure-layer (Layer 3/4) security requirement.
Volumetric DDoS attacks target the network and transport layers (Layers 3 and 4).
AWS Shield Standard provides automatic, always-on protection against common Layer 3 and 4 DDoS attacks at no additional cost.
3
Evaluate and eliminate incorrect firewalls.
Security Groups and Network Access Control Lists (NACLs) operate at Layer 4 and cannot inspect application payloads.
They are unsuitable for Layer 7 SQL injection detection, and AWS Shield Standard automatically covers the Layer 3/4 DDoS protection requirement without manually configuring NACLs or Security Groups for DDoS.

Anahtar Kavram

AWS WAF provides Layer 7 application-layer filtering, whereas AWS Shield Standard automatically protects against Layer 3/4 infrastructure-layer DDoS attacks.
Bu soruyu puanla

Konular

Edge and DDoS Protection

Bu konudan daha fazla soru