Q99 — AWS SAA-C03 Ch.14

Question 99 of 100 | ← Chapter 14

Q1099. A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The company strictly requires that the application be resilient against malicious internet activity and attacks, and protect against new common vulnerabilities and exposures.What should the solutions architect recommend?

Correct Answer: B. Deploy an appropriate managed rule for AWS WAF and associate it with the ALB.

Explanation

To design a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) that is resilient against malicious internet activity and attacks, and protected against new common vulnerabilities and exposures, the solutions architect needs to consider various security measures.Let's evaluate each option:A. Leverage Amazon CloudFront with the ALB endpoint as the origin:Amazon CloudFront is a global content delivery network (CDN) service that accelerates delivery of your websites, APIs, videos, and other content to your users with low latency and high transfer speeds. While CloudFront can help with caching and improving performance, it does not inherently provide protection against malicious internet activity or vulnerabilities. B. Deploy an appropriate managed rule for AWS WAF and associate it with the ALB:AWS WAF (Web Application Firewall) helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. By deploying a managed rule set (such as the AWS Managed Rules for AWS WAF, which include rules based on common web exploits identified by AWS security experts), you can automatically protect your application against known attack patterns and vulnerabilities. Associating this rule set with the ALB ensures that traffic to your application is inspected and malicious requests are blocked before they reach your EC2 instances. C. Subscribe to AWS Shield Advanced and ensure common vulnerabilities and exposures are blocked:AWS Shield Advanced provides DDoS protection for AWS applications running on EC2, Elastic Load Balancing (ELB), Amazon CloudFront, and Amazon Route 53.While Shield Advanced can protect against DDoS attacks, it does not inherently provide protection against common vulnerabilities and exposures.Blocking common vulnerabilities and exposures typically requires a web application firewall (WAF) like AWS WAF.D. Configure network ACLs and security groups to allow only ports 80 and 443 to access the EC2 instances:Network ACLs (Access Control Lists) and security groups are essential for controlling inbound and outbound traffic to your EC2 instances.However, they do not provide protection against application-level attacks or vulnerabilities. They are more suited for controlling access based on IP addresses, ports, and protocols, rather than inspecting and filtering HTTP/HTTPS traffic for malicious content. Given these considerations, Option B (Deploy an appropriate managed rule for AWS WAF and associate it with the ALB) is the most appropriate recommendation to protect the web application against malicious internet activity and attacks, and to safeguard against new common vulnerabilities and exposures.