DOP-C02 Question 381
Select 3Your company runs a web application that is exposed to the internet and processes sensitive user data. It is hosted on an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, your application has been targeted by a series of Distributed Denial of Service (DDoS) attacks and malicious requests attempting SQL injection. As a DevOps Engineer, which combination of AWS security services and configurations should you implement to enhance the application's network security and protect against these threats?
- A
Enable AWS Shield Advanced to mitigate large-scale DDoS attacks and configure it for the Application Load Balancer.
- B
Create and configure web ACLs in AWS WAF to block SQL injection patterns and attach them to the Application Load Balancer.
- C
Configure a security group to allow inbound traffic on port 80 and 443 only from trusted IP addresses.
- D
Use AWS Network Firewall to create rules that inspect traffic at the VPC level and block malicious patterns.
- E
Enable VPC flow logs to monitor and log incoming and outgoing traffic for the EC2 instances.
Show answer and explanation
Correct answers: A, B, D
Explanation
To protect your web application from DDoS attacks and malicious requests such as SQL injection, you need a combination of security measures. AWS Shield Advanced provides robust DDoS protection, AWS WAF allows you to block malicious requests at the application layer, and AWS Network Firewall provides deeper inspection at the VPC level. Security groups and VPC flow logs are useful for access control and monitoring but do not actively mitigate or block these specific threats.
- A. Correct.
Correct: AWS Shield Advanced provides managed DDoS protection for your application, which is crucial for mitigating large-scale attacks. It integrates seamlessly with ALB.
- B. Correct.
Correct: AWS WAF allows you to create rules to filter and block malicious requests, such as those containing SQL injection attempts. Attaching it to the ALB helps protect the application.
- C. Incorrect.
Incorrect: While security groups can restrict traffic based on IP and ports, they cannot detect or block DDoS attacks or SQL injection attempts.
- D. Correct.
Correct: AWS Network Firewall provides additional protection at the VPC level, allowing you to define rules to block traffic patterns associated with threats like SQL injection or other malicious activity.
- E. Incorrect.
Incorrect: VPC flow logs are helpful for monitoring and auditing traffic but do not actively block or mitigate threats.