Q35 — AWS SAA-C03 Ch.16

Question 35 of 100 | ← Chapter 16

Q1235. A company is worried about potential DDoS attacks. The company has a web application that runs on Amazon EC2 instances.The application uses Amazon S3 to serve static content such as images and videos.A solutions architect must create a resilient architecture that can withstand DDoS attacks. Which solution will meet these requirements MOST cost-effectively?

Correct Answer: B. Put the EC2 instances into an Auto Scaling group behind an Elastic Load Balancing (ELB) load balancer. Use Amazon CloudFront with Amazon S3 as an origin.

Explanation

To address the requirement of creating a resilient architecture that can withstand DDoS attacks for a web application running on Amazon EC2 instances with static content served from Amazon S3, let's analyze the options with a focus on cost-effectiveness:Key Requirements:Resilience to DDoS Attacks: The solution must protect the application from DDoS attacks. Cost-Effectiveness: The solution should be as cost-effective as possible while meeting the security requirements.Solution Analysis:Amazon CloudWatch + AWS Lambda for Security Group Updates:Purpose: This approach attempts to mitigate DDoS attacks by blocking inbound traffic to ports 80 and 443 when CPU utilization reaches 90%. However, this is a reactive measure and may not be effective against sophisticated DDoS attacks that can overwhelm the application before CPU utilization reaches 90%. Additionally, blocking traffic to these ports would effectively shut down the application, which is not a viable solution.Auto Scaling Group + Elastic Load Balancer (ELB) + Amazon CloudFront:Purpose:Auto Scaling Group: Automatically scales the number of EC2 instances based on demand, which can help absorb some traffic spikes.Elastic Load Balancer (ELB): Distributes incoming traffic across multiple EC2 instances, improving availability and fault tolerance.Amazon CloudFront: A content delivery network (CDN) that caches content at edge locations, reducing the load on the origin servers (EC2 instances and S3) and providing an additional layer of protection against DDoS attacks by absorbing and mitigating traffic at the edge. Cost-Effectiveness: This solution leverages AWS managed services (Auto Scaling, ELB, CloudFront) that are designed to be scalable and cost-effective. CloudFront, in particular, is a cost-effective way to serve static content and mitigate DDoS attacks.Warm Standby Disaster Recovery (DR) Environment:Purpose: This approach involves maintaining a secondary environment that can be activated in the event of a disaster or attack. However, this is a more expensive and complex solution, as it requires maintaining a fully redundant environment that may not be used frequently.AWS Shield Advanced:Purpose: AWS Shield Advanced provides enhanced DDoS protection for applications running on AWS. It includes 24/7 access to the DDoS Response Team (DRT) and additional features like real-time metrics and reporting.Cost-Effectiveness: While AWS Shield Advanced offers robust protection, it comes with an additional cost. For smaller applications or those with lower risk profiles, the cost may not be justified compared to other, more cost-effective solutions.Evaluating the Options:Option A: Create an Amazon CloudWatch alarm that invokes an AWS Lambda function when an EC2 instance's CPU utilization reaches 90%. Program the Lambda function to update security groups that are attached to the EC2 instance to deny inbound ports 80 and 443. Incorrect: This is not a viable solution for DDoS protection, as it would effectively shut down the application and may not be effective against sophisticated attacks.Option B: Put the EC2 instances into an Auto Scaling group behind an Elastic Load Balancing (ELB) load balancer. Use Amazon CloudFront with Amazon S3 as an origin. Correct: This solution provides a resilient architecture that can withstand DDoS attacks by leveraging AWS managed services (Auto Scaling, ELB, CloudFront). It is cost-effective and does not require maintaining a secondary environment or paying for additional DDoS protection services. Option C: Set up a warm standby disaster recovery (DR) environment. Fail over to the warm standby DR environment if a DDoS attack is detected on the application. Incorrect: This is a more expensive and complex solution that is not necessary for most DDoS protection scenarios.Option D: Subscribe to AWS Shield Advanced. Configure permissions to allow the Shield Response Team to manage resources on the company's behalf during a DDoS event. Incorrect: While AWS Shield Advanced provides robust protection, it is not the most cost-effective solution for all applications, especially those with lower risk profiles.Final Answer:B. Put the EC2 instances into an Auto Scaling group behind an Elastic Load Balancing (ELB) load balancer.Use Amazon CloudFront with Amazon S3 as an origin.This solution provides a resilient architecture that can withstand DDoS attacks in a cost-effective manner by leveraging AWS managed services.