SCS-C02 Question 194
Select 2Your company hosts a web application that serves global users. The application is behind an Application Load Balancer (ALB) in multiple AWS Regions and uses Amazon CloudFront for content delivery. During a security review, you are tasked with implementing measures to mitigate DDoS attacks and prevent SQL injection attempts on the application. Which combination of actions should you take to meet these requirements?
- A
Enable AWS Shield Advanced on the ALB and CloudFront distributions.
- B
Create a web ACL in AWS WAF and associate it with the ALB and CloudFront distributions.
- C
Enable Global Accelerator to automatically mitigate DDoS attacks.
- D
Configure Route 53 health checks to detect DDoS attacks.
- E
Use Security Groups to block traffic from suspicious IP addresses.
Show answer and explanation
Correct answers: A, B
Explanation
To mitigate DDoS attacks, AWS Shield Advanced provides enhanced protection for edge services like CloudFront and Application Load Balancers. AWS WAF helps protect against application-layer threats such as SQL injection. Together, these services offer robust security for your application. Other options, such as Route 53 health checks, Security Groups, and Global Accelerator, are useful for different purposes but are not the best fit for this specific scenario.
- A. Correct.
Correct: AWS Shield Advanced provides enhanced DDoS protection for ALBs, CloudFront distributions, and other edge services, helping mitigate large-scale DDoS attacks.
- B. Correct.
Correct: AWS WAF allows you to create rules to block SQL injection attempts and other web application attacks. Associating it with both the ALB and CloudFront offers layered security.
- C. Incorrect.
Incorrect: While AWS Global Accelerator improves application performance and provides some DDoS protection, it is not a primary tool for mitigating targeted DDoS attacks in this scenario.
- D. Incorrect.
Incorrect: Route 53 health checks are used to monitor the health of endpoints and facilitate DNS failover, but they do not mitigate DDoS attacks or prevent SQL injection attempts.
- E. Incorrect.
Incorrect: Security Groups are useful for controlling inbound and outbound traffic but are not sufficient to block sophisticated DDoS attacks or application-layer threats like SQL injection.