SCS-C02 Question 199
Select 3Your organization has deployed a web application on AWS using an Application Load Balancer (ALB) and Amazon EC2 instances behind it. Recently, the application has been experiencing a significant slowdown due to a large number of HTTP requests coming from a small set of IP addresses. Upon investigation, you suspect this is a Distributed Denial of Service (DDoS) attack. Which of the following steps should you take to mitigate this issue while adhering to AWS best practices?
- A
Enable AWS WAF on the Application Load Balancer and create rules to block requests from the suspicious IP addresses.
- B
Configure rate-based rules in AWS WAF to limit the number of requests from a single IP address.
- C
Use Amazon CloudFront in front of your Application Load Balancer and enable AWS Shield Advanced for additional DDoS protection.
- D
Manually terminate the EC2 instances behind the ALB to stop the attack.
- E
Use VPC security groups to block traffic from the suspicious IP addresses.
Show answer and explanation
Correct answers: A, B, C
Explanation
To mitigate a DDoS attack on a web application hosted on AWS, you should leverage AWS-native services like AWS WAF and Shield Advanced, which are specifically designed to handle such threats. AWS WAF allows you to create rules to block suspicious traffic, while rate-based rules prevent abuse by limiting requests from a single IP. Integrating Amazon CloudFront provides additional layers of protection and reduces the load on your ALB. Manual interventions like terminating instances or using VPC security groups are not recommended as they are either ineffective or disruptive.
- A. Correct.
This is a correct option because AWS WAF allows you to create custom rules to block traffic from specific IP addresses or ranges. This is an effective way to mitigate DDoS attacks.
- B. Correct.
This is a correct option because rate-based rules in AWS WAF can automatically block traffic when a single IP exceeds a specified request rate, helping to mitigate DDoS attacks.
- C. Correct.
This is a correct option because Amazon CloudFront integrates with AWS Shield Advanced, providing additional DDoS protection and mitigating large-scale attacks before they reach your ALB.
- D. Incorrect.
This is not a correct option. Manually terminating EC2 instances does not address the root cause of the attack and could lead to downtime or loss of legitimate traffic.
- E. Incorrect.
This is not a correct option because VPC security groups are not designed to handle DDoS attacks effectively. They lack the advanced features of AWS WAF or Shield for this use case.