SCS-C03 practice question: DDoS protection (Shield Advanced, CloudFront, Route 53)
Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
An online ticket seller runs its sales site on an Application Load Balancer in one Region, behind an Amazon CloudFront distribution. Flash sales create large traffic spikes, and attackers have flooded the site before. The company wants automatic attack detection, access to the AWS DDoS response team during an attack, and protection against the extra scaling charges that an attack can cause.
The load balancer also has a public address that customers can reach directly. The company wants attacks detected from its health checks as well as from traffic patterns.
Which solution meets these requirements?
Choose one answer.
AA. Subscribe to AWS Shield Advanced for the CloudFront distribution only, and rely on CloudFront to hide the load balancer behind it, so that the origin is never reached directly.
BB. Keep AWS Shield Standard, and add AWS WAF rate-based rules to the CloudFront distribution to limit the traffic from each address, which handles most spikes in practice.
CC. Subscribe to AWS Shield Advanced and protect only the Route 53 hosted zone, so that DNS queries get the protection while the rest of the stack stays unchanged.
DD. Subscribe to Shield Advanced, protect the CloudFront distribution, the load balancer and the hosted zone, and attach Route 53 health checks with health-based detection turned on.
Show the answer and explanation
Answer: D
A. Wrong: The load balancer public address still accepts direct traffic, so an attacker can bypass CloudFront and reach it. Shield Advanced protects only the resources that are associated with it.
B. Wrong: Shield Standard and WAF rules do not include the DDoS response team or cost protection for scaling charges. Rate rules also do not use health-based detection.
C. Wrong: A hosted zone protection alone leaves the load balancer and the CloudFront distribution exposed. Health-based detection also needs health checks on the protected resources, which this plan does not set up.
D. Right: Correct. Shield Advanced covers each public entry point, adds the DDoS response team, and gives cost protection for scaling charges during an attack. Health-based detection uses the health checks to find attacks that affect availability. Learn more: Shield Advanced summary (opens in a new tab)
Explanation
Shield Advanced protects every public entry point it is associated with, and it brings the response team and cost protection. Health-based detection needs health checks on those resources. Protecting only one entry point, or staying on Shield Standard, leaves a stated requirement unmet.
Want more on DDoS protection (Shield Advanced, CloudFront, Route 53)? The 5 full-length practice sets have 5 more DDoS protection (Shield Advanced, CloudFront, Route 53) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →