SAP-C02 · Question #459
A company is updating an application that customers use to make online orders. The number of attacks on the application by bad actors has increased recently. The company will host the updated…
The correct answer is A. Create an Amazon CloudFront distribution with the ALB as the origin. Add a custom header and E. Deploy an AWS WAF web ACL that includes an appropriate rule group. Associate the web ACL. The company needs to cost-effectively protect an Amazon ECS application, exposed via a public ALB, from increasing web attacks by bad actors, ensuring business continuity with minimal service interruptions.
Question
A company is updating an application that customers use to make online orders. The number of attacks on the application by bad actors has increased recently. The company will host the updated application on an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use Amazon DynamoDB to store application data. A public Application Load Balancer (ALB) will provide end users with access to the application. The company must prevent attacks and ensure business continuity with minimal service interruptions during an ongoing attack. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
Options
- ACreate an Amazon CloudFront distribution with the ALB as the origin. Add a custom header and
- BDeploy the application in two AWS Regions. Configure Amazon Route 53 to route to both
- CConfigure auto scaling for Amazon ECS tasks Create a DynamoDB Accelerator (DAX) cluster.
- DConfigure Amazon ElastiCache to reduce overhead on DynamoDB.
- EDeploy an AWS WAF web ACL that includes an appropriate rule group. Associate the web ACL
How the community answered
(57 responses)- A44% (25)
- B35% (20)
- C14% (8)
- D7% (4)
Why each option
The company needs to cost-effectively protect an Amazon ECS application, exposed via a public ALB, from increasing web attacks by bad actors, ensuring business continuity with minimal service interruptions.
Creating an Amazon CloudFront distribution with the ALB as the origin provides caching, reduces load, and acts as a first line of defense against DDoS attacks, while also allowing AWS WAF integration for enhanced security.
Deploying the application in two AWS Regions provides disaster recovery and high availability, but it does not directly prevent web attacks or reduce their impact on a single application instance cost-effectively.
Configuring auto scaling for Amazon ECS tasks and a DynamoDB Accelerator (DAX) cluster improves application scalability and database performance, but these do not prevent web attacks or ensure business continuity during an attack.
Configuring Amazon ElastiCache primarily reduces overhead on DynamoDB and improves read performance, but it does not offer protection against web attacks or ensure business continuity during an attack.
Deploying an AWS WAF web ACL with appropriate rule groups and associating it with the ALB directly inspects and filters web traffic to prevent common web exploits and ensure business continuity during attacks.
Concept tested: Web application security with WAF and CloudFront
Source: https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html
Community Discussion
No community discussion yet for this question.