AWS Certified Security – SpecialtyDomain 3: Infrastructure SecurityMedium
A media company is hosting a popular streaming service on AWS, utilizing a fleet of EC2 instances behind an Application Load Balancer (ALB). They are experiencing frequent DDoS attacks targeting their public-facing ALB. The security team needs to implement a solution that provides managed DDoS protection and filters malicious web traffic based on common web exploits. Which AWS service combination should be deployed to address these concerns effectively?
- AAWS Shield Standard and Amazon GuardDuty.
- BAWS Shield Advanced and AWS WAF.
- CAmazon CloudFront with AWS Shield Standard and Security Groups.
- DAWS Firewall Manager and Network ACLs.
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Shield Advanced and AWS WAF.
AWS Shield Advanced provides enhanced DDoS protection for ALBs and other resources, offering more sophisticated detection and mitigation than Shield Standard. AWS WAF (Web Application Firewall) integrates with ALB to filter malicious web traffic based on common web exploits and custom rules, addressing the specific need for web traffic filtering.
Why the other options are wrong
- A. AWS Shield Standard provides basic DDoS protection, but GuardDuty is for threat detection, not active prevention/filtering of web exploits.
- C. CloudFront can provide some DDoS protection and is usually fronted by Shield, but the primary target is the ALB. Security Groups are essential but don't provide managed DDoS or web exploit filtering at the application layer.
- D. AWS Firewall Manager centrally manages WAF rules, Shield Advanced, and Security Groups, but it's a management service, not a direct protection service. Network ACLs are stateless and operate at the network layer, not suitable for filtering web exploits.
Web Application Security Stack
A combination of AWS services like AWS Shield Advanced and AWS WAF to provide comprehensive protection against DDoS attacks and common web exploits for public-facing web applications.
- AWS Shield Advanced for enhanced DDoS protection.
- AWS WAF for filtering web exploits.
- Integrates with ALBs, CloudFront, API Gateway.
Memory trick: ALB's Best Defense: Shield Advanced, WAF's Offense!