SAA-C03 Question 62
Select 3A gaming company is hosting its multiplayer game servers on Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, the company has noticed an increase in malicious activities, including DDoS attacks and SQL injection attempts. Which combination of AWS services and configurations should the company implement to protect against these external threat vectors?
- A
Use AWS WAF to create rules that block SQL injection attempts and malicious IP addresses
- B
Enable AWS Shield Advanced on the Application Load Balancer to mitigate DDoS attacks
- C
Deploy Amazon GuardDuty to detect and automatically block malicious IP addresses
- D
Use AWS Config to monitor and block configuration changes that might expose the system to threats
- E
Implement security groups to allow traffic only from trusted IP ranges
Show answer and explanation
Correct answers: A, B, E
Explanation
To effectively protect against external threats like DDoS attacks and SQL injection, the company should use AWS WAF to block attack patterns, enable AWS Shield Advanced to defend against DDoS attacks, and configure security groups to restrict access to trusted IP ranges. These measures collectively enhance the security posture while maintaining application availability. Amazon GuardDuty and AWS Config are useful for monitoring and compliance but do not directly protect against these specific threat vectors in this scenario.
- A. Correct.
AWS WAF (Web Application Firewall) allows the company to create rules to block specific attack patterns, such as SQL injection attempts, and to block or allow traffic from specific IP addresses. This is highly effective against external threats like SQL injection and is a correct choice.
- B. Correct.
AWS Shield Advanced provides enhanced protection against DDoS attacks for resources like ALBs, ensuring the application remains available during such attacks. This is a correct choice.
- C. Incorrect.
Amazon GuardDuty is a threat detection service that identifies potential threats but does not automatically block them. It provides insights, not direct protection, making this an incorrect choice for this scenario.
- D. Incorrect.
AWS Config is used to monitor and ensure compliance with configuration rules but is not directly involved in mitigating external threats like DDoS or SQL injection. This is an incorrect choice.
- E. Correct.
Security groups act as virtual firewalls for EC2 instances, allowing traffic only from trusted sources. Configuring them to allow traffic only from known and trusted IP ranges helps prevent unauthorized access. This is a correct choice.