SAP-C02 Question 299
Select 2An e-commerce company runs a web application hosted in an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer (ALB). The company notices a sudden spike in traffic that causes latency issues and intermittent application errors. After reviewing the logs, you discover that the traffic spike is due to a Distributed Denial of Service (DDoS) attack. Which combination of actions should you take to mitigate the attack while ensuring minimal disruption to legitimate users?
- A
Enable AWS Shield Advanced and configure rate-based rules in AWS WAF to block abnormal traffic patterns.
- B
Increase the maximum size of the Auto Scaling group to handle the increased traffic load.
- C
Use Amazon CloudFront with geo-restriction and AWS WAF to block traffic from specific geographic locations.
- D
Configure the ALB to drop requests that exceed a certain request rate per client IP address.
- E
Use AWS Global Accelerator to distribute traffic across multiple AWS Regions.
Show answer and explanation
Correct answers: A, C
Explanation
To mitigate a DDoS attack while ensuring minimal disruption to legitimate users, you should use AWS Shield Advanced for enhanced DDoS protection and AWS WAF for granular traffic filtering. Geo-restriction with Amazon CloudFront can further block traffic from regions associated with the attack. Increasing the Auto Scaling group or using AWS Global Accelerator does not address the root cause of the issue.
- A. Correct.
Correct. AWS Shield Advanced provides enhanced DDoS protection, and rate-based rules in AWS WAF can block traffic from malicious sources without affecting legitimate users.
- B. Incorrect.
Incorrect. Increasing the Auto Scaling group's capacity may temporarily handle the load but does not mitigate the attack itself and could lead to unnecessary costs.
- C. Correct.
Correct. Amazon CloudFront with geo-restriction and AWS WAF can block traffic from regions where the attack originates, reducing the attack's impact while maintaining service for legitimate users.
- D. Incorrect.
Incorrect. While the ALB can handle some request filtering, it is not designed for advanced DDoS mitigation. AWS WAF is better suited for such scenarios.
- E. Incorrect.
Incorrect. AWS Global Accelerator improves performance and availability but does not provide DDoS protection or mitigate traffic spikes caused by an attack.