Discuss Amazon SAP-C02 Exam Topic 1 Question 35

A medical company is running a REST API on a set of Amazon EC2 instances The EC2 instances run in an Auto Scaling group behind an Application Load Balancer (ALB) The ALB runs in three public subnets, and the EC2 instances run in three private subnets The company has deployed an Amazon CloudFront distribution that has the ALB as the only origin

Which solution should a solutions architect recommend to enhance the origin security?

AStore a random string in AWS Secrets Manager Create an AWS Lambda function for automatic secret rotation Configure CloudFront to inject the random string as a custom HTTP header for the origin request Create an AWS WAF web ACL rule with a string match rule for the custom header Associate the web ACL with the ALB

BCreate an AWS WAF web ACL rule with an IP match condition of the CloudFront service IP address ranges Associate the web ACL with the ALB Move the ALB into the three private subnets

CStore a random string in AWS Systems Manager Parameter Store Configure Parameter Store automatic rotation for the string Configure CloudFront to inject the random string as a custom HTTP header for the origin request Inspect the value of the custom HTTP header, and block access in the ALB

DConfigure AWS Shield Advanced. Create a security group policy to allow connections from CloudFront service IP address ranges. Add the policy to AWS Shield Advanced, and attach the policy to the ALB

Suggested Answer: A

Store Secret in AWS Secrets Manager:

Create a random string in AWS Secrets Manager to be used as a custom HTTP header value.

Set Up Automatic Rotation:

Implement a Lambda function to handle automatic rotation of the secret in AWS Secrets Manager, ensuring the header value remains secure.

Configure CloudFront Custom Header:

In the CloudFront distribution settings, configure an origin custom header with the name and value from AWS Secrets Manager. This header will be included in requests forwarded to the ALB.

Create AWS WAF Web ACL:

Create a Web ACL in AWS WAF with a string match rule to allow requests that include the custom header with the correct value.

Associate the Web ACL with the ALB to filter incoming traffic based on the custom header.

By using this method, you can ensure that only requests coming through CloudFront (which injects the custom header) can reach the ALB, enhancing the origin security

Get Premium SAP-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

36 comments · newest first

Cassandra 11 months ago

Wait, can you really use a random string for security like that? Sounds risky!

Jesusita 11 months ago

D is interesting, but does AWS Shield really add that much security?

Laticia 11 months ago

C seems a bit complicated, not sure if it's worth the effort.

Melissa 11 months ago

I think B is better, moving the ALB to private subnets adds more security.

Tesha 12 months ago

Option A sounds solid with the secret rotation and WAF integration.

Pearlene 12 months ago

I vaguely remember that using AWS Secrets Manager is a common practice for securing sensitive data, so option A could be the right answer, but I need to think it through more.

Skye 1 year ago

I feel like option B might be a good choice since it mentions moving the ALB to private subnets, but I wonder if that would complicate things.

Lawrence 1 year ago

I think option A sounds familiar because we practiced using custom headers with CloudFront, but I can't recall if that's the most secure approach.

Carlee 1 year ago

I remember discussing the importance of using AWS WAF for securing APIs, but I'm not sure which option best enhances origin security here.

Lovetta 1 year ago

Option A seems like a good approach - using a custom header with CloudFront and WAF to add an extra layer of security. I'll make sure to review the details on how to implement that properly.

Oretha 1 year ago

Hmm, I'm a bit confused by all the different AWS services mentioned. I'll need to make sure I understand how they work together before I can decide on the best solution.

Marshall 1 year ago

This looks like a tricky security question. I'll need to carefully review the options and think through the different approaches.

Brock 1 year ago

I'm leaning towards Option D. Configuring AWS Shield Advanced and a security group policy to allow only CloudFront traffic sounds like a straightforward way to enhance the origin security.

Carma 1 year ago

This is a tricky one. I'll need to carefully review the information on atherosclerosis progression and regression to determine the best answer.

Quentin 1 year ago

This question seems straightforward, I think I can handle it.

Truman 1 year ago

Hmm, I'm a bit unsure about this one. The wording is a little confusing, and I'm not entirely sure what "loss assets" refers to in this context. I'll need to think it through carefully before selecting an answer.

Marg 2 years ago

A all the way, baby! Rotating those random strings is like a security version of the Hokey Pokey - put your secret in, put your secret out, and shake it all about!

Linette 2 years ago

D? Nope, not feeling it. AWS Shield Advanced? More like AWS Shield from reality, amirite?

Chana 2 years ago

↳ replying to Linette

C) Store a random string in AWS Systems Manager Parameter Store Configure Parameter Store automatic rotation for the string Configure CloudFront to inject the random string as a custom HTTP header for the origin request Inspect the value of the custom HTTP header, and block access in the ALB

Portia 2 years ago

↳ replying to Linette

B) Create an AWS WAF web ACL rule with an IP match condition of the CloudFront service IP address ranges Associate the web ACL with the ALB Move the ALB into the three private subnets

Verlene 2 years ago

↳ replying to Linette

A) Store a random string in AWS Secrets Manager Create an AWS Lambda function for automatic secret rotation Configure CloudFront to inject the random string as a custom HTTP header for the origin request Create an AWS WAF web ACL rule with a string match rule for the custom header Associate the web ACL with the ALB

Shakira 2 years ago

↳ replying to Linette

Cyndy 2 years ago

↳ replying to Linette

B) Create an AWS WAF web ACL rule with an IP match condition of the CloudFront service IP address ranges Associate the web ACL with the ALB Move the ALB into the three private subnets

Tenesha 2 years ago

↳ replying to Linette

Elfrieda 2 years ago

I'm not sure about option A. I think option D with AWS Shield Advanced could also be a good choice for enhancing security.

Lenora 2 years ago

C? Nah, I'm not feeling it. Mixing Parameter Store with CloudFront headers? Sounds like a recipe for a security-themed magic show.

Dion 2 years ago

I agree with Lynelle. Option A seems to provide a strong security measure with AWS WAF.

Alishia 2 years ago

B? Really? Moving the ALB behind private subnets? That's like locking the front door and leaving the back window wide open.

Yuki 2 years ago

↳ replying to Alishia

D) Configure AWS Shield Advanced. Create a security group policy to allow connections from CloudFront service IP address ranges. Add the policy to AWS Shield Advanced, and attach the policy to the ALB

Youlanda 2 years ago

↳ replying to Alishia

Lynelle 2 years ago

I think option A sounds like a good solution. It involves rotating a random string for security.

Shawnda 2 years ago

Hmm, I think A is the way to go. Rotating those random strings is like a security dance - keep 'em guessing!

Bobbye 2 years ago

↳ replying to Shawnda

Rotating random strings with AWS Secrets Manager is a good practice.

Tammi 2 years ago

↳ replying to Shawnda

I think A is a solid choice for enhancing origin security.

Candra 2 years ago

↳ replying to Shawnda

Definitely, it's like a security dance to keep the origin secure.

Ira 2 years ago

↳ replying to Shawnda

I agree, rotating those random strings adds an extra layer of security.

Amazon SAP-C02 Exam - Topic 1 Question 35 Discussion