A company is updating an online ordering application hosted on Amazon ECS, using DynamoDB for storage and a public ALB for user access. Attacks against the application have increased. The company must prevent attacks and ensure business continuity with minimal interruptions and be cost-effective. Which combination of steps meets these requirements MOST cost-effectively? (Choose two.)
Choose an answer
Tap an option to check your answer.
Correct answer: Create a CloudFront distribution with the ALB as origin. Add a custom header with a random value at the CloudFront domain and configure the ALB to forward traffic only when that header and value match., Deploy an AWS WAF web ACL with an appropriate rule group and associate the web ACL with the CloudFront distribution..
Why this is the answer
The combination of CloudFront with a custom header and AWS WAF provides robust security and performance cost-effectively. CloudFront acts as a CDN, caching content closer to users, improving performance, and absorbing some DDoS attacks. The custom header ensures that only requests originating from CloudFront reach the ALB, preventing direct access to the origin and bypassing security controls. AWS WAF, associated with CloudFront, filters malicious traffic based on defined rules, protecting against common web exploits. Deploying in two Regions increases resilience but is more expensive and doesn't directly prevent attacks. ECS auto scaling and DAX improve performance and scalability but don't address security threats. ElastiCache reduces DynamoDB load but also doesn't prevent attacks.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed