Exam AWS Certified Security - Specialty topic 1 question 278 discussion

C. "The AWS WAF API supports security automation such as blacklisting IP addresses that exceed request limits, which can be useful for mitigating HTTP flood attacks." > https://aws.amazon.com/blogs/security/how-to-protect-dynamic-web-applications-against-ddos-attacks-by-using-amazon-cloudfront-and-amazon-route-53/

Why to write code for Lambda@Edge to rate-limit request at the time we already have WAF enabled?! Correct answer is C.

Rate based rules on AWS WAF are super effective!

To improve the security at the edge of the solution to defend against a large, layer 7 DDoS attack, the security engineer can configure AWS WAF with a rate-based rule that imposes a rate limit that automatically blocks requests when the rate limit is exceeded. So the correct answer would be option C.

Option A, configuring the CloudFront distribution to use the Lambda@Edge feature to impose a rate limit on viewer requests, is a valid solution for DDoS protection, but it may not be the most efficient or effective option in this case. This option requires additional resources and complexity in terms of configuring and managing the Lambda function, and it may not be able to scale to handle a large-scale DDoS attack. Option C, configuring AWS WAF with a rate-based rule that imposes a rate limit, is a more efficient and effective solution as it directly addresses the threat of a layer 7 DDoS attack by limiting the number of requests that can be made to the application. Option D, configuring the CloudFront distribution to use AWS WAF as its origin, is not a valid solution as it does not address the problem of DDoS attack.

Why create a lambda function when WAF rate based rule does the job for you

For sure option C solves the issue, but I think that lamdba@edge rate limit can also be implemented: https://github.com/jkahn117/aws-edge-blocking...

C. https://docs.aws.amazon.com/whitepapers/latest/guidelines-for-implementing-aws-waf/ddos-attacks-at-layer-7.html

c !!!!!!!!!!!!!!!!!!!!!!!

Correct Answer: C A sounds like it would be correct since the question is asking about improving security at the "edge" and the answer includes "lambda@edge" so it's easy to think oh this is right but its not. I don't think lambda functions can impose rate limiting on requests by themselves.

C is the answer.

C is my answer.!

C for me is the answer. Use WAF rate based rule to limit the amount of requests from a particular location.

For Layer 7 DDos Attacks, it should be either WAF or AWS Sheild, we need to reconsider the answers here, , B or C Looks closer to right Answer

A is right

Is it C?