AWS Certified Solutions Architect – Professional — Question 906

As a part of building large applications in the AWS Cloud, the Solutions Architect is required to implement the perimeter security protection. Applications running on AWS have the following endpoints:
✑ Application Load Balancer
✑ Amazon API Gateway regional endpoint
✑ Elastic IP address-based EC2 instances.
✑ Amazon S3 hosted websites.
✑ Classic Load Balancer
The Solutions Architect must design a solution to protect all of the listed web front ends and provide the following security capabilities:
✑ DDoS protection
✑ SQL injection protection
✑ IP address whitelist/blacklist
✑ HTTP flood protection
✑ Bad bot scraper protection
How should the Solutions Architect design the solution?

Answer options

• A. Deploy AWS WAF and AWS Shield Advanced on all web endpoints. Add AWS WAF rules to enforce the company's requirements.
• B. Deploy Amazon CloudFront in front of all the endpoints. The CloudFront distribution provides perimeter protection. Add AWS Lambda-based automation to provide additional security.
• C. Deploy Amazon CloudFront in front of all the endpoints. Deploy AWS WAF and AWS Shield Advanced. Add AWS WAF rules to enforce the company's requirements. Use AWS Lambda to automate and enhance the security posture.
• D. Secure the endpoints by using network ACLs and security groups and adding rules to enforce the company's requirements. Use AWS Lambda to automatically update the rules.

Correct answer: C

Explanation

Deploying Amazon CloudFront in front of all endpoints provides a unified entry point and allows the integration of AWS WAF and AWS Shield Advanced for comprehensive Layer 3, 4, and 7 protection. AWS WAF can easily handle SQL injection, IP whitelisting/blacklisting, and HTTP floods, while AWS Lambda can automate log analysis to block bad bot scrapers. Other options either fail to support all endpoint types (such as AWS WAF directly on Classic Load Balancers or S3 websites) or lack the deep packet inspection capabilities of WAF.