ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Solutions Architect - Professional SAP-C02 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Professional SAP-C02 exam
Go to Exam

Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 159 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional SAP-C02
Question #: 159
Topic #: 1
[All AWS Certified Solutions Architect - Professional SAP-C02 Questions]

A company has a website that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The ALB is associated with an AWS WAF web ACL.

The website often encounters attacks in the application layer. The attacks produce sudden and significant increases in traffic on the application server. The access logs show that each attack originates from different IP addresses. A solutions architect needs to implement a solution to mitigate these attacks.

Which solution will meet these requirements with the LEAST operational overhead?

  • A. Create an Amazon CloudWatch alarm that monitors server access. Set a threshold based on access by IP address. Configure an alarm action that adds the IP address to the web ACL’s deny list.
  • B. Deploy AWS Shield Advanced in addition to AWS WAF. Add the ALB as a protected resource.
  • C. Create an Amazon CloudWatch alarm that monitors user IP addresses. Set a threshold based on access by IP address. Configure the alarm to invoke an AWS Lambda function to add a deny rule in the application server’s subnet route table for any IP addresses that activate the alarm.
  • D. Inspect access logs to find a pattern of IP addresses that launched the attacks. Use an Amazon Route 53 geolocation routing policy to deny traffic from the countries that host those IP addresses.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by schalke04 at Feb. 2, 2023, 5:04 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
God_Is_Love
Highly Voted 2 years, 3 months ago
Selected Answer: B
AWS Shield Advanced is focused on protecting against DDoS attacks, while AWS WAF is focused on protecting against web exploits. However, both services can be used together to provide comprehensive protection for your applications.
upvoted 14 times
...
shmoeee
Most Recent 4 months, 2 weeks ago
Selected Answer: B
I chose B since this is a DDOS attack and also option A could cause issues if legitimate traffic gets thrown on the ACL deny list
upvoted 1 times
...
nelgeozcin
7 months ago
Selected Answer: B
" The access logs show that each attack originates from different IP addresses. " implies DDoS
upvoted 1 times
...
Incognito013
10 months, 1 week ago
Selected Answer: A
Nothing mentioned about DDoS in the question, plus A is simplier and less operational oevrhead
upvoted 1 times
helloworldabc
10 months ago
just B
upvoted 1 times
...
...
career360guru
1 year, 5 months ago
Selected Answer: B
Option B sounds most logical answer in terms of least operational overhead. though it does not provide details about how to identify and add those IP addresses to Shield Advanced for DDos protection.
upvoted 2 times
...
Reejith
1 year, 6 months ago
I think its option A. Option B is a paid service and it is for DDoS. Here that attack is not DDoS and it is excess traffic generated at application layer by certain IPs. Not in a distributed attack pattern. Advanced shield will give DDoS+WAF. But you already have WAF and using which you can block the IPs that is crossing set threshold. So option A is better choice. Option B is additional cost. Option C is wrong as you can not add deny rule in route table. Route table has only routes. Option D is operational overhead and then if you block the whole country , genuine traffic will also get blocked, which is not good.
upvoted 4 times
...
SK_Tyagi
1 year, 10 months ago
Selected Answer: B
"Least" Operational Overhead - B
upvoted 1 times
...
NikkyDicky
1 year, 11 months ago
Selected Answer: B
B 100%
upvoted 1 times
...
SkyZeroZx
2 years ago
Selected Answer: B
Research more information and correct my answer Letter B with this information https://docs.aws.amazon.com/waf/latest/developerguide/ddos-app-layer-protections.html
upvoted 1 times
...
SkyZeroZx
2 years ago
Selected Answer: A
For me it would be the letter A Because AWS Shield Advanced is for DDOS attacks that happen at layer 3. However, in the question they say attacks in the application layer "The website often encounters attacks in the application layer." For this reason, I would consider that it cannot be B and A would be a more feasible solution. If anyone has more data, welcome to improve the community Attached answer from Bard from Google Here are some additional details about each solution:
upvoted 4 times
SkyZeroZx
2 years ago
Solution C: This solution would require creating an AWS Lambda function, which is a paid service. AWS Lambda is a serverless compute service that allows you to run code without provisioning or managing servers. The Lambda function would be used to inspect access logs and identify IP addresses that are launching attacks. The function would then add those IP addresses to the application server's subnet route table, which would prevent traffic from those IP addresses from reaching the application server.
upvoted 1 times
...
SkyZeroZx
2 years ago
Solution D: This solution would require inspecting access logs, which can be a time-consuming process. The access logs would be used to find a pattern of IP addresses that launched the attacks. The IP addresses could then be used to create a geolocation routing policy in Amazon Route 53. The geolocation routing policy would deny traffic from the countries that host those IP addresses. Overall, solution A is the most efficient solution because it uses existing AWS services and does not require any additional infrastructure.
upvoted 1 times
...
SkyZeroZx
2 years ago
Solution A: This solution is the most efficient because it uses existing AWS services and does not require any additional infrastructure. The CloudWatch alarm will monitor server access and trigger an action when the threshold is reached. The action can be configured to add the IP address to the web ACL's deny list, which will prevent traffic from that IP address from reaching the application server. Solution B: This solution would require deploying AWS Shield Advanced, which is a paid service. AWS Shield Advanced provides additional protection against DDoS attacks, including application layer attacks. However, it is more expensive than AWS WAF.
upvoted 1 times
Daniel76
8 months, 2 weeks ago
The attack is at the application layer. Solution A detects attack by IP which is at network layer, hence it is not valid.
upvoted 1 times
...
...
...
dev112233xx
2 years, 2 months ago
Selected Answer: B
״with the LEAST operational overhead״ is AWS SHIELD Advanced without doubts✅
upvoted 3 times
...
hpipit
2 years, 2 months ago
Selected Answer: B
B 100% AWS SHIELD
upvoted 2 times
...
mfsec
2 years, 2 months ago
Selected Answer: B
Deploy AWS Shield Advanced in addition to AWS WAF.
upvoted 2 times
...
rtgfdv3
2 years, 3 months ago
as long as i know or think to know, shield advanced, does nothing by default and needs to be configured. https://docs.aws.amazon.com/waf/latest/developerguide/enable-ddos-prem.html https://docs.aws.amazon.com/waf/latest/developerguide/getting-started-ddos.html Note Shield Advanced doesn't automatically protect your resources after you subscribe. You must specify the resources you want Shield Advanced to protect configure the protections.
upvoted 2 times
...
moota
2 years, 4 months ago
Selected Answer: B
According to ChatGPT, the ff are what you get with Advanced over Basic. AWS Shield Advanced is a paid version of the service that provides additional protection against large scale and sophisticated DDoS attacks. This version includes all the features of the Basic version, but with additional capabilities such as 24/7 availability, a dedicated DDoS response team, and advanced attack analytics and reporting. Additionally, AWS Shield Advanced provides access to advanced DDoS protection and mitigation capabilities, such as the ability to customize protections for specific application requirements, and to mitigate attacks more quickly and effectively.
upvoted 3 times
...
Musk
2 years, 4 months ago
Selected Answer: B
Reading more about option B, I pick B
upvoted 4 times
...
Musk
2 years, 4 months ago
Not sure. With WAF you get Shield, which hs DDoS. Not sure the the Shield dvnced gives you much more.
upvoted 1 times
...
Load full discussion...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel