Examkin

Soru

Zorluk: ZorEdge and DDoS Protection

A collaborative document editing SaaS platform uses an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances. During a high-profile product release, the platform experiences a distributed HTTP flood attack (Layer 7 DDoS) consisting of rapid, repeating requests from thousands of unique, dynamically changing IP addresses. This attack is bypassing standard network-level protections and exhausting EC2 CPU resources. The platform's operations team needs to mitigate this attack immediately and ensure the ALB only accepts traffic routed through their edge protection layer. Which combination of actions will meet these requirements with the least administrative effort?

  1. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer. Associate an AWS WAF web ACL containing a rate-based rule with the CloudFront distribution. Configure the Application Load Balancer's security group to restrict inbound traffic using the CloudFront managed prefix list.Cevap
  2. B
    Enable AWS Shield Standard on the Application Load Balancer. Configure AWS Shield Standard to rate-limit incoming HTTP requests. Restrict the Application Load Balancer's security group to only accept traffic from the Amazon Route 53 IP ranges.
  3. C
    Create a stateless Network Access Control List (NACL) at the subnet level for the Application Load Balancer. Add rules to block the IP addresses originating the HTTP flood. Restrict the EC2 instance security groups to allow traffic only from the ALB.
  4. D
    Deploy an Amazon CloudFront distribution in front of the Application Load Balancer. Enable AWS Shield Advanced on the CloudFront distribution. Rely on the default AWS Shield Advanced infrastructure protection to automatically drop all Layer 7 HTTP flood requests without configuring AWS WAF.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, associate an AWS WAF web ACL with a rate-based rule to the distribution, and configure the ALB's security group to restrict inbound traffic to the CloudFront managed prefix list.
The correct option outlines a secure architecture by placing Amazon CloudFront at the edge, leveraging AWS WAF rate-based rules to dynamically block the high-volume HTTP flood at the application layer, and securing the Application Load Balancer origin using the CloudFront managed prefix list to ensure no traffic bypasses the edge defense.

Adım Adım Çözüm

1
Introduce Amazon CloudFront as the entry point.
Legitimate and malicious traffic is routed through CloudFront's global edge locations instead of directly hitting the Application Load Balancer.
This establishes an edge network layer capable of handling massive volumes of traffic and caching static content.
2
Deploy AWS WAF with a rate-based rule associated with the CloudFront distribution.
IP addresses that send more requests than the defined threshold within a 5-minute window are automatically blocked at the edge.
Layer 7 HTTP floods must be mitigated dynamically at the application layer before reaching the backend application origin.
3
Restrict backend access to the Application Load Balancer.
The ALB security group is modified to allow inbound traffic only from the CloudFront managed prefix list.
This prevents malicious users from bypassing CloudFront and AWS WAF by directly targeting the ALB's public IP address or DNS name.

Anahtar Kavram

AWS WAF rate-based rules combined with Amazon CloudFront and ALB security group restrictions provide comprehensive Layer 7 DDoS mitigation and origin cloaking.
Bu soruyu puanla

Konular

Edge and DDoS Protection

Bu konudan daha fazla soru