Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 248 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional SAP-C02

Question #: 248
Topic #: 1

[All AWS Certified Solutions Architect - Professional SAP-C02 Questions]

An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container Service (Amazon ECS) cluster in an Auto Scaling group behind an Application Load Balancer (ALB). A system administrator detects a weekly spike in the number of failed login attempts, which overwhelm the application's authentication service. All the failed login attempts originate from about 500 different IP addresses that change each week. A solutions architect must prevent the failed login attempts from overwhelming the authentication service.

Which solution meets these requirements with the MOST operational efficiency?

A. Use AWS Firewall Manager to create a security group and security group policy to deny access from the IP addresses.
B. Create an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. Connect the web ACL to the ALB.
C. Use AWS Firewall Manager to create a security group and security group policy to allow access only to specific CIDR ranges.
D. Create an AWS WAF web ACL with an IP set match rule, and set the rule action to Block. Connect the web ACL to the ALB.

Show Suggested Answer

Suggested Answer: B 🗳️

by bhanus at June 22, 2023, 10:30 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

totten

Highly Voted 8 months, 1 week ago

Selected Answer: B

Option B provides the most operational efficiency to prevent the weekly spike in failed login attempts. Here's why: AWS WAF (Web Application Firewall) with a rate-based rule allows you to monitor and block traffic based on the rate of requests from different IP addresses. The rate-based rule can help identify and block the excessive login attempts originating from a large number of IP addresses that change weekly. By blocking traffic at the ALB level using AWS WAF, the traffic doesn't reach the application, reducing the load on your authentication service. The rate-based rule can automatically adjust to changing patterns of attack without manual updates, providing an efficient solution. AWS WAF is designed for web application protection and allows you to create flexible rules to mitigate various types of attacks, making it a suitable choice for handling this scenario.

upvoted 7 times

...

85b5b55

Most Recent 4 weeks ago

Selected Answer: B

IP rate-based Rule.

upvoted 1 times

...

career360guru

6 months, 4 weeks ago

Selected Answer: B

Using WAF with ALB is most operationally efficient. This narrows the choices down to B and D. As IP address keeps changing B is most efficient.

upvoted 3 times

...

joleneinthebackyard

7 months, 3 weeks ago

Selected Answer: B

The application should be used by users "around the world" so policies that IP based are not suitable, as you have to update set of new IPs each week. Option B has valid actions, as WAP webACL has rate-basted rule and Block Action.

upvoted 2 times

...