AWS Certified Devops Engineer Professional · Free Practice Question Medium
Question 5
An application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application is used by users around the world who access the application using a custom DNS domain name. The application must support encryption in transit, be protected from DDoS attacks and web exploits, should be optimized for performance.
Which actions should a DevOps engineer take to meet these requirements? (Select TWO.)
-
A
Create an AWS WAF web ACL, configure a default action and rule, and specify the CloudFront distribution that WAF should inspect.
-
B
Create an AWS WAF web ACL, configure a default action and rule, and specify the Auto Scaling group that WAF should inspect.
-
C
Create an Amazon CloudFront distribution with the Auto Scaling group as an origin. Configure the custom domain name and attach an SSL/TLS certificate.
-
D
Create an Amazon CloudFront distribution with the ALB as an origin. Configure the custom domain name and attach an SSL/TLS certificate.
-
E
Create an AWS WAF web ACL, configure a default action and rule, and specify the ALB that WAF should inspect.
Reveal correct answers
Correct answers: A, D
Explanation
To improve performance for global users the solution should use Amazon CloudFront. The distribution should specify the ALB as the origin and use a custom domain name and SSL/TLS certificate. This will enable caching of content in Edge Locations around the world and CloudFront offers DDoS protection.
To protect against web exploits AWS WAF should be used. A Web ACL must be created with an action and rule specified to deal with threats. The web ACL can be specified in the CloudFront distribution.
CORRECT: "Create an Amazon CloudFront distribution with the ALB as an origin. Configure the custom domain name and attach an SSL/TLS certificate" is a correct answer (as explained above.)
CORRECT: "Create an AWS WAF web ACL, configure a default action and rule, and specify the CloudFront distribution that WAF should inspect" is also a correct answer (as explained above.)
INCORRECT: "Create an Amazon CloudFront distribution with the Auto Scaling group as an origin. Configure the custom domain name and attach an SSL/TLS certificate" is incorrect.
You can configure an ELB as an origin for the distribution, but you cannot specify an ASG.
INCORRECT: "Create an AWS WAF web ACL, configure a default action and rule, and specify the ALB that WAF should inspect" is incorrect.
The web ACL should be attached to the CloudFront distribution in this case as it sits in front of the ALB. It is always better to protect as close to the edge as possible.
INCORRECT: "Create an AWS WAF web ACL, configure a default action and rule, and specify the Auto Scaling group that WAF should inspect" is incorrect.
The web ACL must be attached to the CloudFront distribution, not the ASG.
References:
https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html
https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
