Q97 — AWS SAA-C03 Ch.10

Question 97 of 100 | ← Chapter 10

Q697. A city has deployed a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's users have reported sporadic performance which appears to be related to DDoS attacks originating from random IP addresses. The city needs a solution that requires minimal configuration changes and provides an audit trail for the DDoS sources.Which solution meets these requirements?

Correct Answer: C. Subscribe to AWS Shield Advanced. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service

Explanation

To meet the requirements of requiring minimal configuration changes and providing an audit trail for DDoS sources, the following solution should be implemented:C. Subscribe to AWS Shield Advanced. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.Option C provides a comprehensive solution for mitigating DDoS attacks and meeting the stated requirements:- Subscribe to AWS Shield Advanced: AWS Shield Advanced is a managed DDoS protection service that provides advanced protection against DDoS attacks. By subscribing to AWS Shield Advanced, the city can benefit from enhanced DDoS mitigation capabilities tailored specifically for AWS services.- Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service: The AWS DDoS Response Team (DRT) is a team of security experts who can work with customers to provide guidance and assistance in mitigating DDoS attacks. By engaging the DRT, the city can receive specialized support in integrating mitigating controls into their environment.Option A, enabling an AWS WAF web ACL on the ALB and configuring rules to block traffic from unknown sources, provides some level of protection against DDoS attacks by blocking traffic from unknown sources. However, it does not provide the same level of comprehensive DDoS protection and support as AWS Shield Advanced and the DRT.Option B, subscribing to Amazon Inspector and engaging the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service, is not the recommended solution for mitigating DDoS attacks. Amazon Inspector is a vulnerability assessment service and does not directly address DDoS protection.Option D, creating an Amazon CloudFront distribution for the application, setting the ALB as the origin, and enabling an AWS WAF web ACL on the distribution to block traffic from unknown sources, is a valid solution for protecting the application with AWS WAF. However, it does not provide the same level of specialized DDoS protection and support as AWS Shield Advanced and the DRT.Therefore, the best solution is C: Subscribe to AWS Shield Advanced and engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service. This solution provides advanced DDoS protection and specialized support while requiring minimal configuration changes and providing an audit trail for DDoS sources.