Examkin

Soru

Zorluk: OrtaEdge and DDoS Protection

A gaming company hosts a real-time multiplayer application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application recently experienced service degradation due to a large-scale UDP flood attack targeting the ALB. The company needs to implement a solution that automatically mitigates these Layer 3 and Layer 4 DDoS attacks at the edge before they reach the ALB, while ensuring low-latency access for legitimate players. Which solution should a solutions architect recommend?

  1. Deploy Amazon CloudFront in front of the Application Load Balancer. CloudFront provides inherent protection against Layer 3 and Layer 4 attacks at the AWS edge network through integrated AWS Shield Standard.Cevap
  2. B
    Create stateless Network Access Control Lists (NACLs) at the subnet level of the ALB to dynamically monitor and block the traffic signatures of the UDP flood.
  3. C
    Deploy AWS WAF and associate it with the Application Load Balancer. Configure an AWS WAF Web ACL with rate-based rules to block the incoming UDP flood traffic.
  4. D
    Configure the security groups associated with the Application Load Balancer to allow only TCP traffic, and configure AWS Route 53 latency routing to distribute UDP traffic across multiple AWS Regions.

Cevap

Deploy Amazon CloudFront in front of the Application Load Balancer to leverage the built-in DDoS protection provided by AWS Shield Standard at the AWS edge network.
Deploying Amazon CloudFront in front of the Application Load Balancer utilizes AWS's global edge locations to absorb and mitigate Layer 3 and Layer 4 DDoS attacks automatically using AWS Shield Standard. This ensures that malicious UDP flood traffic is blocked before reaching the VPC or the ALB, preserving system availability and latency.

Adım Adım Çözüm

1
Identify the network layer of the DDoS attack.
The UDP flood represents a Layer 3/4 network and transport layer attack.
Classifying the attack layer allows the selection of the correct AWS protection tools, separating infrastructure shielding from web application filtering.
2
Evaluate perimeter edge services versus internal VPC controls.
Amazon CloudFront intercepts traffic at global edge locations and natively integrates with AWS Shield Standard.
Mitigating attacks at the edge isolates the origin resources and scales horizontally before traffic hits the Application Load Balancer.
3
Review the inadequacy of Layer 7, DNS, or stateful instance protections.
AWS WAF (Layer 7), security groups, and NACLs are unsuited to drop high-volume UDP floods efficiently at scale.
Discarding incorrect options reinforces why edge infrastructure proxying is the architecturally sound design.

Anahtar Kavram

Edge protection against Layer 3 and Layer 4 DDoS attacks is best achieved using Amazon CloudFront integrated with AWS Shield Standard.
Bu soruyu puanla

Konular

Edge and DDoS Protection

Bu konudan daha fazla soru