SCS-C02 Question 197
Select 3You are managing a high-traffic e-commerce application hosted on AWS. Recently, your application experienced a Distributed Denial of Service (DDoS) attack that disrupted customer access to the website. To mitigate such attacks in the future, which combination of AWS services and features should you implement?
- A
Use AWS Shield Advanced to provide DDoS protection and access to the DDoS Response Team (DRT).
- B
Implement Amazon CloudFront with Web Application Firewall (WAF) to block malicious traffic closer to the edge.
- C
Enable AWS Config to automatically remediate security vulnerabilities caused by DDoS attacks.
- D
Configure AWS Elastic Load Balancer (ELB) to distribute incoming traffic across multiple instances.
- E
Use Amazon GuardDuty to detect and block DDoS attacks in real time.
Show answer and explanation
Correct answers: A, B, D
Explanation
To effectively mitigate DDoS attacks, you should use a combination of AWS Shield Advanced for direct DDoS protection, Amazon CloudFront with AWS WAF to filter malicious traffic closer to users, and Elastic Load Balancer to distribute traffic and improve availability. These services work together to provide a layered defense strategy against DDoS threats. GuardDuty and AWS Config are valuable for security monitoring and compliance but are not designed to actively mitigate DDoS attacks.
- A. Correct.
AWS Shield Advanced provides enhanced DDoS protection and access to the DDoS Response Team (DRT), which is critical in mitigating large-scale attacks.
- B. Correct.
Amazon CloudFront with AWS WAF can block malicious traffic at the edge, reducing latency and preventing bad traffic from reaching your application.
- C. Incorrect.
AWS Config is a configuration management tool, but it does not directly mitigate or remediate DDoS attacks.
- D. Correct.
AWS Elastic Load Balancer helps distribute incoming traffic across multiple instances, which can increase resilience during a DDoS attack by spreading the traffic load.
- E. Incorrect.
Amazon GuardDuty is a threat detection service that identifies potential security threats but does not actively block DDoS attacks or mitigate their effects.