SCS-C02 Question 198
Select 3You are managing a web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB) in AWS. Recently, you have noticed a surge in application errors due to what appears to be a DDoS attack targeting your infrastructure. Which of the following actions should you take to mitigate this attack while ensuring legitimate traffic can still access the application?
- A
Enable AWS WAF and configure rules to block suspicious traffic patterns.
- B
Activate AWS Shield Advanced to gain additional DDoS protection and use its incident response team.
- C
Manually block the attacking IP addresses using security group rules on the EC2 instances.
- D
Scale up the EC2 instances to handle the increased traffic caused by the attack.
- E
Implement rate-based rules in AWS WAF to limit traffic from specific IPs or regions.
Show answer and explanation
Correct answers: A, B, E
Explanation
DDoS attacks can overwhelm application resources, but AWS offers multiple services to mitigate such threats. AWS WAF enables fine-grained traffic filtering with customizable rules, making it an effective tool for blocking attack patterns. AWS Shield Advanced provides advanced DDoS protection and access to expert teams for incident response. Rate-based rules in AWS WAF further enhance protection by limiting traffic rates from suspicious sources. Together, these actions help mitigate DDoS attacks while allowing legitimate traffic to access the application.
- A. Correct.
Correct: AWS WAF allows you to configure rules to block or allow specific patterns, which is a highly effective way to mitigate DDoS attacks in combination with other protections.
- B. Correct.
Correct: AWS Shield Advanced provides enhanced DDoS protection and access to the AWS DDoS Response Team (DRT), which can assist in mitigating large-scale attacks.
- C. Incorrect.
Incorrect: Manually blocking IPs using security group rules is not scalable or practical for mitigating DDoS attacks, as attackers often use a large number of IPs.
- D. Incorrect.
Incorrect: Scaling up EC2 instances may temporarily absorb the load but does not address the root cause of the attack. It can also become costly and ineffective against persistent DDoS attacks.
- E. Correct.
Correct: Rate-based rules in AWS WAF can limit requests from specific IPs or regions, helping to block malicious traffic while allowing legitimate traffic.