Examkin

Soru

Zorluk: OrtaEdge and DDoS Protection

A financial services firm hosts a banking API on AWS using an Application Load Balancer (ALB) and Amazon EC2 instances in a private subnet. The API has recently been targeted by sudden HTTP flood attacks consisting of a high volume of HTTP POST requests, which exhaust the CPU resources of the backend EC2 instances. The firm needs to mitigate these application-layer (Layer 7) attacks at the network edge before they reach the ALB. Which solution should a solutions architect recommend?

  1. A
    Configure stateless Network Access Control Lists (NACLs) at the subnet level to block incoming traffic based on the rate and payload of HTTP POST requests.
  2. B
    Configure a security group on the Application Load Balancer to dynamically rate-limit incoming HTTP POST requests and block offending clients.
  3. Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate AWS WAF with the CloudFront distribution using a rate-based rule.Cevap
  4. D
    Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and rely on AWS Shield Standard to inspect and block the Layer 7 HTTP POST request floods.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate AWS WAF with the CloudFront distribution using a rate-based rule.
The correct solution uses Amazon CloudFront as a caching and distribution layer at the AWS edge to act as the first line of defense. By associating AWS WAF with the CloudFront distribution, the architecture can inspect Layer 7 HTTP traffic. A WAF rate-based rule counts requests from individual IP addresses and temporarily blocks them if they exceed a defined threshold (e.g., 100 requests per 5 minutes). This prevents the HTTP flood from reaching the regional Application Load Balancer and overloading the backend EC2 instances.

Adım Adım Çözüm

1
Analyze the attack vector and mitigation requirements.
The attack is a Layer 7 HTTP flood (POST requests) causing CPU exhaustion on backend servers, which must be blocked at the edge before hitting the ALB.
Identifying the layer of the attack (Layer 7) determines the tool needed (AWS WAF) rather than network-level firewalls (Security Groups or NACLs).
2
Evaluate the architectural entry point for edge protection.
Amazon CloudFront distributes traffic across AWS edge locations, absorbing Layer 3 and 4 traffic globally.
Deploying CloudFront allows the security controls to be evaluated close to the client, preventing malicious traffic from reaching the regional VPC resources.
3
Select the appropriate security service and rule type for Layer 7 rate limiting.
AWS WAF with a rate-based rule is associated with the CloudFront distribution.
AWS WAF rate-based rules automatically track request rates from individual IP addresses and apply a block action once the configured threshold is breached, mitigating HTTP floods dynamically.

Anahtar Kavram

Layer 7 DDoS mitigation at the AWS network edge using Amazon CloudFront and AWS WAF rate-based rules.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Edge and DDoS Protection

Bu konudan daha fazla soru