Q52 — AWS SAP-C02 Ch.2

Question 52 of 75 | ← Chapter 2

Q202. A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone.The company is concerned about security and wants a solutions architect to re-architect the solution to meet the following requirements. -Inbound requests must be filtered for common vulnerability attacks. -Rejected requests must be sent to a third-party auditing application. -All resources should be highly available. Which solution meets these requirements?

• A. Configure a Multi-AZ Auto Scaling group using the application's AMI Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Use Amazon Inspector to monitor traffic to the ALB and EC2 instances. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB. Use an AWS Lambda function to frequently push the Amazon Inspector report to the third-party auditing application.
• B. Configure an Application Load Balancer (ALB) and add the EC2 instances as targets, Create a web ACL in WAF Create an AWS WAF using the web ACL and ALB name and enable logging with Amazon CloudWatch Logs. Use an AWS Lambda function to frequently push the logs to the third-party auditing application.
• C. Configure an Application Load Balancer (ALB) along with a target group adding the EC2 instances as targets. Create an Amazon Kinesis Data Firehose with the destination of the third-party auditing application. Create a web ACL in WAF Create an AWS WAF using the web,ACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.
• D. Configure a Multi-AZ Auto Scaling group using the application' s AMI.Create an Application Load Balancer (ALB) and sect the previously created Auto Scaling group as the target .Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application.Create a web ACL in WAF Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination Subscribe to AWS Managed Rules in AWS Marketplace,choosing the WAF as the subscriber. ✓

Correct Answer: D. Configure a Multi-AZ Auto Scaling group using the application' s AMI.Create an Application Load Balancer (ALB) and sect the previously created Auto Scaling group as the target .Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application.Create a web ACL in WAF Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination Subscribe to AWS Managed Rules in AWS Marketplace,choosing the WAF as the subscriber.

Explanation

Option A suggests configuring a Multi-AZ Auto Scaling group using the application's AMI, creating an Application Load Balancer (ALB), monitoring traffic using Amazon Inspector, and creating a WAF, but it does not include sending rejected requests to a third-party auditing application. Option B suggests configuring an Application Load Balancer (ALB) and adding the EC2 instances as targets, creating a WAF, and enabling logging with CloudWatch Logs, but it does not include sending rejected requests to a third-party auditing application or leveraging Amazon Kinesis Data Firehose for log delivery. Option C suggests configuring an Application Load Balancer (ALB) along with a target group adding the EC2 instances as targets, creating Amazon Kinesis Data Firehose with a destination to the third-party auditing application, creating a WAF, and subscribing to AWS Managed Rules in AWS Marketplace, but it does not include directing rejected requests to the third-party auditing application. Therefore, option D is the best solution to meet the given requirements. The solution includes configuring a Multi-AZ Auto Scaling group using the application's AMI, creating an Application Load Balancer (ALB), creating Amazon Kinesis Data Firehose with a destination to the third-party auditing application, creating a WAF, and subscribing to AWS Managed Rules in AWS Marketplace, and directing rejected requests to the third-party auditing application.