Q1 — AWS SAA-C03 Ch.14

Question 1 of 100 | ← Chapter 14

Q1001. A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS.The company needs a managed solution with proactive engagement to detect against DDoS attacks.Which solution will meet these requirements?

• A. Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
• B. Enable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the ALB.
• C. Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
• D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources. ✓

Correct Answer: D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.

Explanation

To implement a managed solution with proactive engagement to detect and defend against DDoS attacks for an application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB), the best solution is:D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.Explanation:AWS Shield Advanced: This service provides enhanced DDoS protection for applications running on AWS. It includes proactive detection and mitigation against DDoS attacks, making it suitable for applications that require high availability and security.Integration with Route 53: By configuring hosted zones in Route 53 and adding ALB resources as protected, you ensure that the application benefits from advanced DDoS protection, including real-time attack visibility and access to a 24/7 DDoS response team.Evaluation of Other Options:A. Enable AWS Config...: AWS Config helps with resource configuration management and compliance but does not specifically detect DDoS attacks.B. Enable AWS WAF on the ALB: While AWS WAF can help protect against certain types of web-based attacks, it is not a comprehensive DDoS protection solution. It focuses more on application layer attacks rather than network layer DDoS attacks.C. Store the ALB access logs in an S3 bucket...: Using GuardDuty for DDoS detection based on logs is reactive rather than proactive. It does not provide the same level of protection as Shield Advanced, which is specifically designed for DDoS mitigation.In summary, Option D is the most effective solution for providing managed, proactive DDoS protection for the application hosted in the AWS Cloud.