ANS-C01 Question 80
Select 3You are designing a high-availability architecture for a global web application hosted on Amazon Elastic Kubernetes Service (Amazon EKS). The application needs to serve users with low latency across multiple regions and must protect against DDoS attacks. Additionally, the solution must use HTTPS for secure communication. Which combination of AWS services should you use to meet these requirements?
- A
AWS Global Accelerator
- B
Amazon Route 53
- C
AWS WAF
- D
AWS Certificate Manager (ACM)
- E
Amazon CloudFront
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the requirements of low latency, DDoS protection, and secure HTTPS communication, you should use a combination of AWS WAF for security, ACM for managing SSL/TLS certificates, and Route 53 for DNS-based routing across multiple regions. Global Accelerator and CloudFront can also improve performance and security, but they are not strictly necessary for this specific application architecture.
- A. Correct.
AWS Global Accelerator improves global application performance and provides fault tolerance by routing users to the nearest healthy region. However, it does not natively handle HTTPS certificates or DDoS protection, so it is not sufficient on its own.
- B. Incorrect.
Amazon Route 53 provides DNS-based routing and health checks but does not directly handle HTTPS certificates or DDoS protection. It is a complementary service rather than a standalone solution for this use case.
- C. Correct.
AWS WAF can protect against common web exploits and DDoS attacks. It integrates with services like CloudFront and Application Load Balancer, making it a critical component for application security.
- D. Correct.
AWS Certificate Manager (ACM) simplifies the process of issuing and managing SSL/TLS certificates, enabling secure HTTPS communication for your application.
- E. Incorrect.
Amazon CloudFront is a content delivery network (CDN) that reduces latency by caching content closer to users. While it can work with ACM for HTTPS and AWS WAF for DDoS protection, it is not mandatory for this architecture unless content caching is required.