ANS-C01 Question 445
Select 4Your company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, the application has been experiencing unauthorized access attempts and distributed denial-of-service (DDoS) attacks, degrading performance. As the network architect, which steps should you take to mitigate these security threats while ensuring legitimate traffic is not blocked?
- A
Enable AWS Shield Advanced for enhanced DDoS protection.
- B
Use AWS WAF to define rules that block suspicious IP addresses and patterns.
- C
Move the application to a dedicated EC2 instance without a load balancer.
- D
Implement an Elastic IP address to ensure the application has a fixed public IP.
- E
Configure ALB with HTTPS and enforce SSL/TLS for secure communication.
- F
Enable VPC Flow Logs to monitor and analyze network traffic for malicious activity.
Show answer and explanation
Correct answers: A, B, E, F
Explanation
To mitigate security threats such as unauthorized access and DDoS attacks, a multi-layered approach is required. Enabling AWS Shield Advanced helps protect against DDoS attacks. AWS WAF allows for fine-grained control over traffic filtering, blocking malicious patterns. Securing communication with HTTPS and analyzing traffic using VPC Flow Logs further enhances security and visibility. Moving the application to a single EC2 instance or using an Elastic IP does not address these security challenges effectively and could compromise scalability and flexibility.
- A. Correct.
AWS Shield Advanced provides enhanced protection against DDoS attacks, including detailed attack diagnostics and cost protection for scaling during a DDoS event.
- B. Correct.
AWS WAF allows you to create rules to filter out malicious traffic, such as blocking specific IP addresses, SQL injection attempts, or other suspicious patterns.
- C. Incorrect.
Moving the application to a single dedicated EC2 instance without a load balancer reduces scalability and does not help mitigate security threats like DDoS attacks.
- D. Incorrect.
Using an Elastic IP address does not directly mitigate security threats like DDoS or unauthorized access. It only provides a fixed public IP for the application, which could actually make it easier for attackers to target.
- E. Correct.
Configuring ALB with HTTPS and enforcing SSL/TLS ensures secure communication between clients and the load balancer, preventing man-in-the-middle attacks.
- F. Correct.
Enabling VPC Flow Logs allows detailed monitoring of network traffic, helping to identify suspicious activity and potential attack patterns.