Examkin

Soru

Zorluk: KolayEdge and DDoS Protection

A company hosts a public-facing web application on AWS. The company needs to protect the application from common web exploits, such as SQL injection, and from infrastructure-layer DDoS attacks, such as UDP floods. Which two AWS services should the solutions architect utilize to meet these requirements? (Select TWO.)

  1. AWS WAF to inspect incoming HTTP/HTTPS traffic and block common web exploitsCevap
  2. AWS Shield Standard to safeguard the application against common Layer 3 and Layer 4 DDoS attacksCevap
  3. C
    Network Access Control Lists (NACLs) to block SQL injection payloads at the subnet boundary
  4. D
    Security Groups to analyze application-layer payloads and prevent cross-site scripting
  5. E
    Amazon Inspector to continuously monitor and block incoming UDP flood attacks in real time

Cevap

To meet the requirements, the solutions architect should use AWS WAF to inspect HTTP/HTTPS traffic and block web exploits like SQL injection, and use AWS Shield Standard to protect against infrastructure-layer DDoS attacks like UDP floods.
The correct options are the services that inspect and protect different layers of the application network stack. AWS WAF provides Layer 7 inspection to block common web exploits like SQL injection by analyzing the HTTP request payload. AWS Shield Standard provides automatic Layer 3 and Layer 4 DDoS protection to mitigate infrastructure attacks like UDP floods before they reach the application resources.

Adım Adım Çözüm

1
Identify the service required to protect against Layer 7 application-layer exploits (such as SQL injection).
AWS WAF is designed specifically for this purpose, inspecting HTTP/HTTPS traffic at Layer 7.
Web application firewalls inspect the payload of HTTP requests to identify and block patterns associated with SQL injection and cross-site scripting.
2
Identify the service required to protect against Layer 3 and Layer 4 infrastructure DDoS attacks (such as UDP floods).
AWS Shield Standard provides automatic protection against these types of attacks at the AWS edge.
AWS Shield Standard operates at the network and transport layers to defend resources from high-volume attacks like UDP floods.
3
Evaluate the remaining options to ensure they do not meet the security and architectural requirements.
Security groups and Network ACLs operate at Layer 3/4 but lack application-layer inspection or automatic managed DDoS mitigation capabilities. Amazon Inspector is a vulnerability scanner, not a real-time traffic filtering or DDoS protection tool.
This confirms that the selected services are the correct and optimal choices for the architecture.

Anahtar Kavram

Combining AWS WAF for Layer 7 application protection and AWS Shield Standard for Layer 3/4 infrastructure DDoS protection is the standard AWS best practice for edge security.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Edge and DDoS Protection

Bu konudan daha fazla soru