Q26 — AWS SAA-C03 Ch.16

Question 26 of 100 | ← Chapter 16

Q1226. A company runs an application on a group of Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to protect the application against layer 7 DDoS attacks.Which solution will meet this requirement?

Correct Answer: C. Create an AWS WAF web ACL and add an AWS managed rule. Associate the web ACL to the ALB

Explanation

To protect the application against layer 7 (application layer) DDoS attacks, let's analyze the options:Key Requirements:Layer 7 DDoS Protection: The solution must protect against DDoS attacks at the application layer (e.g., HTTP/HTTPS floods, SQL injection attempts, etc.).Application Load Balancer (ALB): The protection must be applied to the ALB, which is the entry point for the application.Solution Analysis:AWS Shield Standard:AWS Shield Standard provides basic DDoS protection for all AWS customers at no additional cost. It protects against common network and transport layer (layers 3 and 4) DDoS attacks. However, it does not provide protection against layer 7 (application layer) DDoS attacks.AWS WAF (Web Application Firewall):AWS WAF is designed to protect web applications from common web exploits and layer 7 DDoS attacks. It can be configured with rules to block or allow traffic based on conditions like IP addresses, HTTP headers, URI strings, SQL injection patterns, and more.AWS WAF can be associated with an ALB, Amazon CloudFront, or API Gateway to provide protection. AWS WAF offers both AWS-managed rules (pre-configured rules for common threats) and custom rules (user-defined rules).Amazon CloudFront:CloudFront can be used in conjunction with AWS WAF to provide additional protection and caching benefits. However, CloudFront alone does not provide layer 7 DDoS protection unless AWS WAF is associated with it.Evaluating the Options:Option A: Associate AWS Shield Standard with the ALB.Incorrect: AWS Shield Standard does not provide layer 7 DDoS protection. Option B: Create an AWS WAF web ACL and add a custom rule. Associate the web ACL with the ALB. Partially Correct: This would work, but it requires the company to manually create and maintain custom rules, which may not cover all common layer 7 threats. AWS-managed rules are often a better starting point.Option C: Create an AWS WAF web ACL and add an AWS managed rule. Associate the web ACL to the ALB.Correct: AWS-managed rules are pre-configured to protect against common layer 7 threats (e.g., SQL injection, cross-site scripting, HTTP floods). This is the most straightforward and effective solution for layer 7 DDoS protection.Option D: Create an Amazon CloudFront distribution and set the ALB as the origin. Configure the application DNS record to point to the CloudFront distribution instead of the ALB. Incorrect: While this can improve performance and provide some additional protection, it does not inherently protect against layer 7 DDoS attacks unless AWS WAF is associated with the CloudFront distribution. This option is incomplete without AWS WAF.Final Answer:C. Create an AWS WAF web ACL and add an AWS managed rule. Associate the web ACL to the ALB.This solution leverages AWS-managed rules to provide comprehensive protection against layer 7 DDoS attacks and other common web exploits.