SCS-C02 Question 184
Select 3An e-commerce company is using an Amazon CloudFront distribution to deliver their website content to customers globally. The company needs to ensure that only authenticated users can access certain restricted pages while also protecting against DDoS attacks and ensuring data security in transit. Which combination of security controls should you implement to meet these requirements?
- A
Enable AWS WAF with customized rules to block malicious traffic.
- B
Configure Field-Level Encryption in CloudFront for sensitive user data in transit.
- C
Use an Origin Access Control (OAC) to restrict direct access to the S3 bucket.
- D
Integrate CloudFront with AWS Shield Advanced for enhanced DDoS protection.
- E
Enable Geo-Restriction in CloudFront to block access from specific countries.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, you should implement AWS WAF for application layer security, Field-Level Encryption to secure sensitive data in transit, and integrate AWS Shield Advanced for enhanced DDoS protection. These controls collectively ensure data security, authenticated access, and protection against malicious threats, while other options like Geo-Restriction and Origin Access Control address different use cases not directly relevant to this scenario.
- A. Correct.
Correct. AWS WAF can be configured to block malicious requests and protect the application from common web vulnerabilities such as SQL injection and cross-site scripting, aligning with the requirement to protect against DDoS attacks.
- B. Correct.
Correct. Field-Level Encryption ensures secure data transmission by encrypting sensitive data fields, such as personally identifiable information (PII) or payment details, when content is delivered via CloudFront.
- C. Incorrect.
Incorrect. While Origin Access Control (OAC) restricts direct access to S3 buckets, it is not directly related to securing content delivery for authenticated users or protecting against DDoS attacks.
- D. Correct.
Correct. AWS Shield Advanced provides additional advanced DDoS protection for CloudFront distributions, helping mitigate volumetric attacks and ensuring application availability.
- E. Incorrect.
Incorrect. Geo-Restriction blocks requests from specific countries but does not directly address the requirements for authenticated access or DDoS protection.