A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS. The co

Question

Options

• AEnable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
• BEnable AWS WAF on the ALB Create an AWS WAF web ACL with rules to detect and prevent
• CStore the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and
• DSubscribe to AWS Shield Advanced. Configure hosted zones in Route 53 Add ALB resources as

• A
  4% (1)
• B
  4% (1)
• D
  91% (21)

Explanation

AWS Shield Advanced is designed to provide enhanced protection against DDoS attacks with proactive engagement and response capabilities, making it the best solution for this scenario. AWS Shield Advanced: This service provides advanced protection against DDoS attacks. It includes detailed attack diagnostics, 24/7 access to the AWS DDoS Response Team (DRT), and financial protection against DDoS-related scaling charges. Shield Advanced also integrates with Route 53 and the Application Load Balancer (ALB) to ensure comprehensive protection for your web applications. Route 53 and ALB Protection: By adding your Route 53 hosted zones and ALB resources to AWS Shield Advanced, you ensure that these components are covered under the enhanced protection plan. Shield Advanced actively monitors traffic and provides real-time attack mitigation, minimizing the impact of DDoS attacks on your application. Why Not Other Options? Option A (AWS Config): AWS Config is a configuration management service and does not provide DDoS protection or detection capabilities. Option B (AWS WAF): While AWS WAF can help mitigate some types of attacks, it does not provide the comprehensive DDoS protection and proactive engagement offered by Shield Option C (GuardDuty): GuardDuty is a threat detection service that identifies potentially malicious activity within your AWS environment, but it is not specifically designed to provide DDoS

No community discussion yet for this question.