A benefits enrollment company is hosting a 3-tier web application running in a VPC on AWS which includes a
NAT (Network Address Translation) instance in the public Web tier. There is enough provisioned capacity for
the expected workload tor the new fiscal year benefit enrollment period plus some extra overhead Enrollment
proceeds nicely for two days and then the web tier becomes unresponsive, upon investigation using
CloudWatch and other monitoring tools it is discovered that there is an extremely large and unanticipated
amount of inbound traffic coming from a set of 15 specific IP addresses over port 80 from a country where the
benefits company has no customers. The web tier instances are so overloaded that benefit enrollment
administrators cannot even SSH into them. Which activity would be useful in defending against this attack?
A.
Create a custom route table associated with the web tier and block the attacking IP addresses from the IGW
(internet Gateway)
B.
Change the EIP (Elastic IP Address) of the NAT instance in the web tier subnet and update the Main Route
Table with the new EIP
C.
Create 15 Security Group rules to block the attacking IP addresses over port 80
D.
Create an inbound NACL (Network Access control list) associated with the web tier subnet with deny rules
to block the attacking IP addresses
Hi,
I would go for answer D
See also: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html
Any thoughts on this are welcome.
Regards,
Frank
Agree with Frank. D would be more appropriate.
am not convince about those answers A and D, since we may not deny any incoming by 15 specific IP addresses. But we can specify the CIDR block in both NACL and route table.
i think only B is correct here
Not correct because it won’t make any difference as it is not about the NAT EIPs. The web URL is there anyway so they can obtain the new addresses and still do their thing. It is about blocking the IPs.
It is D.
A doesnt make sense
B NAT is for outbound traffic and not inbound (in fact the reason it’s is for it allow outbound traffic for private instances at the same time blocking any inbound traffic)
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html
C is wrong, there is no deny rule (only allow) in Security Groups.
D is the easiest solution with the quickest resolution time.
D
D is correct you can block ingres traffic from specified IPS using network ACLs
D
D
D is the only answer ,
Security group doesnot allow deny rules 🙂