Q26 — AWS SAA-C03 Ch.14

Question 26 of 100 | ← Chapter 14

Q1026. A company uses AWS to host its public ecommerce website. The website uses an AWS Global Accelerator accelerator for traffic from the internet. The Global Accelerator accelerator forwards the traffic to an Application Load Balancer (ALB) that is the entry point for an Auto Scaling group.The company recently identified a DDoS attack on the website. The company needs a solution to mitigate future attacks.Which solution will meet these requirements with the LEAST implementation effort?

Correct Answer: C. Configure an AWS WAF web ACL on the ALB to block traffic by using rate-based rules

Explanation

To mitigate future DDoS attacks on the public ecommerce website hosted on AWS with the least implementation effort, the best solution is:C. Configure an AWS WAF web ACL on the ALB to block traffic by using rate-based rules.Explanation:\1. AWS WAF on Application Load Balancer: - Configuring AWS WAF (Web Application Firewall) directly on the Application Load Balancer provides a straightforward way to monitor and filter incoming traffic. You can create rules that block or allow requests based on specified conditions, including rate-based rules that can help mitigate DDoS attacks by limiting the number of requests from individual IP addresses.\2. Ease of Implementation: - Adding AWS WAF to the ALB is a relatively simple process that integrates well with existing AWS services. It allows for immediate protection without significant changes to the architecture.\3. Rate-Based Rules: - By using rate-based rules in AWS WAF, you can automatically block IP addresses that exceed a specified request threshold over a defined period. This is particularly effective against DDoS attacks, which often involve a high volume of requests from a limited number of sources.Evaluation of Other Options:A. Configure an AWS WAF web ACL for the Global Accelerator accelerator to block traffic by using rate-based rules: - While this option is valid, it requires configuring WAF at the Global Accelerator level, which can introduce additional complexity compared to directly protecting the ALB.B. Configure an AWS Lambda function to read the ALB metrics to block attacks by updating a VPC network ACL: - This solution is more complex and requires custom development and maintenance. Network ACLs are also less flexible than WAF rules for application-layer protection.D. Configure an Amazon CloudFront distribution in front of the Global Accelerator accelerator: - While using CloudFront can enhance security and provide DDoS mitigation capabilities, it involves more setup and configuration compared to directly applying WAF to the ALB. It may also introduce latency due to additional routing.Conclusion:Option C provides the most effective and least effortful solution to mitigate future DDoS attacks by leveraging AWS WAF directly on the Application Load Balancer, allowing for immediate and efficient protection against high-volume attacks.