Q28 — AWS SAA-C03 Ch.6

Question 28 of 65 | ← Chapter 6

Q393. A solution architect is performing a security review of a recently migrated workload. The workload is a web application that consists of amazon EC2 instances in an Auto Scaling group behind an Application Load balancer. The solution architect must improve the security posture and minimize the impact of a DDoS attack on resources.Which solution is MOST effective?

• A. Configure an AWS WAF ACL with rate-based rules Create an Amazon CloudFront distribution that points to the Application Load Balancer. Enable the EAF ACL on the CloudFront distribution ✓
• B. Create a custom AWS Lambda function that adds identified attacks into a common vulnerability pool to capture a potential DDoS attack. use the identified information to modify a network ACL to block access.
• C. Enable VPC Flow Logs and store then in Amazon S3. Create a custom AWS Lambda functions that parses the logs looking for a DDoS attack. Modify a network ACL to block identified source IP addresses.
• D. Enable Amazon GuardDuty and , configure findings written 10 Amazon GloudWatch Create an event with Cloud Watch Events for DDoS alerts that triggers Amazon Simple Notification Service (Amazon SNS) Have Amzon SNS invoke a custom AWS lambda function that parses the logs looking for a DDoS attack Modify a network ACL to block identified source IP addresses

Correct Answer: A. Configure an AWS WAF ACL with rate-based rules Create an Amazon CloudFront distribution that points to the Application Load Balancer. Enable the EAF ACL on the CloudFront distribution

Explanation

This solution is the most effective as it leverages AWS WAF (Web Application Firewall) with rate-based rules to detect and block suspicious traffic, including Distributed Denial of Service (DDoS) attacks. By creating an Amazon CloudFront distribution and enabling the AWS WAF ACL on it, the traffic to the Application Load Balancer will be routed through CloudFront, which provides additional protection against DDoS attacks. The rate-based rules in AWS WAF allow you to set thresholds for requests to trigger rate- limiting actions, effectively mitigating the impact of DDoS attacks and improving the security posture of the workload.Following WAF: You can use AWS WAF web access control lists (web ACLs) to help minimize the effects of a distributed denial of service (DDoS) attack.The question attention: must improve the security posture and minimize the impact of a DDoS attack. In all the other options NACL is involved to fix the problem. NACL won't see the attackers (source) IP given it sits behind an ALB.so B,C,D are all incorrect.