AWS Certified Security – Specialty — Question 230

A company has implemented AWS WAF and Amazon CloudFront for an application. The application runs on Amazon EC2 instances that are part of an Auto
Scaling group. The Auto Scaling group is behind an Application Load Balancer (ALB).
The AWS WAF web ACL uses an AWS Managed Rules rule group and is associated with the CloudFront distribution. CloudFront receives the request from AWS
WAF and the uses the ALB as the distribution's origin.
During a security review, a security engineer discovers that the infrastructure is susceptible to a large, layer 7 DDoS attack.
How can the security engineer improve the security at the edge of the solution to defend against this type of attack?

Answer options

• A. Configure the CloudFront distribution to use the Lambda@Edge feature. Create an AWS Lambda function that imposes a rate limit on CloudFront viewer requests. Block the request if the rate limit is exceeded.
• B. Configure the AWS WAF web ACL so that the web ACL has more capacity units to process all AWS WAF rules faster.
• C. Configure AWS WAF with a rate-based rule that imposes a rate limit that automatically blocks requests when the rate limit is exceeded.
• D. Configure the CloudFront distribution to use AWS WAF as its origin instead of the ALB.

Correct answer: C

Explanation

The correct answer is C because a rate-based rule in AWS WAF can help mitigate DDoS attacks by automatically blocking requests that exceed the defined rate limit. Option A involves Lambda@Edge, which is not specifically designed for DDoS protection. Option B increases capacity but does not directly address the rate of requests. Option D would not effectively prevent DDoS attacks since AWS WAF needs to be configured to filter traffic effectively, not just change origins.