Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Learn AWS > AWS DDOS > Flashcards

AWS DDOS Flashcards

1
Q

To mitigate DDOS, what is the recommended approach?

A
  • Be ready and able to scale.
  • Minimise attach surface
  • What is normal, need to be monitoring to understand what is normal
  • Plan for attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

With regard to DDOS, what should you be doing with your attack surface?

A

Minimizing the attack surface, this means minimizing the footprint exposed to the internet, by way of securing all ports not required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

To mitigate a DDOS attack, what infrastructure services can you use?

A

ELB to balance traffic between autoscaled instances, so as the DDOS load increases so does the ability to absorb the increase of traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

With regard to the attack surface, what should you be doing when designing an application and infrastructure on AWS to deal with DDOS?

A

Minimizing the attack surface by decoupling your application into layers, with only the layer like the web layer exposed to the internet. Keep all other layers in private VPC, ensure only one service per instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

With regard to DDOS and having a decoupled application infrastructure, what AWS components are good for decoupling?

A

SQS, Elastic Beanstalk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

With regard to DDOS and knowing what is normal, what services can help in this area?

A

SNS, CloudWatch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

With regard to DDOS, do you need a plan?

A 
Yes, you need a plan,
Same app
Country
Nature (SYN flood, App)
Have business support should be in place
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What services can help mitigate DDOS?

A
  • Cloudfront CDN is designed to mitigate any attack so your content is always available.
  • Route53 is designed to mitigate the attack and be always available.
  • Autoscaling enables your app to absorbed attack
  • ELB enables your app to scale
  • WAF
  • VPC & Security groups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the five DDOS attack vectors?

A 
UDP reflection attacks
UDP flood
TCP SYN flood
Web application layer
DNS query flood
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is rate based blacklisting?

A

It is the ability of a WAF to blacklist traffic on its rate if some bad actor is DDOSing your application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a syn cookie and how dose it helkp with syn flooding?

A

A syn cookiis is returned with the syn+ack to a syn, it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What tequniques is AWS using to mitigate DDOS attacks?

A

Allow only valid traffic
SYN- Cookie
Suspicion-based traffic shaping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How will the AWS ELB mitigate DDOS attack?

A
  • ELB will start to scale our as traffic arives.
  • AWS Blackwatch kickes in to protect the ELB and apply blackwatch mitigation.
  • This is why you wnat your app to also auto scale
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a Syn flood attack?

A

A syn attach is an attack where many syns are sent to try to overflow the table used to track syn requests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the mitigation used for syn attacks?

A

Use syn cookies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is UDP reflection attacks?

A

Where the stateless nature of UPD is used to have another server respond to the target IP to a request sent by another server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are application layer attacks?

A

Where Lare 7, the application layer protocol is used to try to overflow many parts of the application, like, cache.

18
Q

Do you get DDOS mitigation from AWS?

A

Yes, you get transport layer DDOS mitigation on all services?

19
Q

I have an application, it is a single server web facing, how cna I easily get DDOS protection on it?

A

Add an LB, even tho you do not need the lB feature. AWS LB has built-in DDOS protection for the transport layer.

20
Q

What services could I use from AWS to protect again DDOS attacks?

A

You can use LB, Route53 and CloudFront as all these services have DDOS protection builtin, where AWS baselines traffic and mitigates.

21
Q

What are the following group of DDOS attacks, syn, UDP reflection, UDP flood?

A

Transport layer group

22
Q

I need to secure my API from DDOS, how can I do this?

A

Using an ELB is an option, but you can also use CloudFront as you can have API delivered to the origin as CF can deal with dynamic content.

23
Q

What services help mitigate DDOS attacks?

A 
AWS WAF (
Route53
AWS API GW
VPC (Reflection attacks)
EC2 (Reflection attack)
24
Q

What will placing the ELB in front of instances do for security?

A

ELC stops many attacks but needs WAFfor l7

25
Q

What protection does ALB offer?

A

Blocks, Many common DDOS attacks.

26
Q

How do CF help again DDOS attacks?

A

It baselines traffic and filters, it also protects again syn attacks, UDP floods and scales.

27
Q

I want to block traffic based on signature, what service can I use?

A

You cna use CF and ELB

28
Q

I want to block traffic based on signature, what service can I use?

A

You cna use CF and ELB pr Advanced WAF

29
Q

I want to get restrict traffic to help protect again attacks, what options do I have?

A

WAF and CF enable you to restrict traffic by GEO, Route53 also can restrict its traffic by GEO.

30
Q

How can I ensure that only traffic from CF is sent to my origin?

A

You can set up a custom header in CF

31
Q

I have an API on EC2 instance, how could I protect this?

A

CF does a good job of providing DDOS attacks and works for dynamic content. So does API Gateway, with API GW you have edge optimised.

32
Q

From an operational perspective, what must you have

A

Visibility. Cloudwatch, network flows,

33
Q

What are DDoSAttackBitsPerSecond, DDoSAttackPacketsPerSecond, or
DDoSAttackRequestsPerSecond

A

They are a metric in Cloudwatch that show you a DDOS attack, only available on the advanced shield. You should have an alarm set on these.

34
Q

What is DDoSDetected?

A

It is on the shield and enables you to know if DDOS is happening.

35
Q

What is the difference between DOS and DDOS?

A

DOS is a using attacker, DDOS is multiple coordinated attackers

36
Q

How do you minimize the attack surface?

A

Reduce entry points.
do not expose middle or backend
separate user and management traffic

37
Q

How do you scale to absorb attack?

A

Auto scale ELB & ELB

  • Horizontal scale with ELB
  • EC2 vertical scale
  • Enhanced networking enables more traffic to be processed by instance.
  • CloudFront
  • WAF
38
Q

When using Shield Advance, what happens to your ACL’s in relation to the edge?

A

During an attack, your ACL’s are enforced at the edge of the AWS network, stopping traffic out at the edge and close to where it comes to form.

39
Q

What are the top 10 to protect again DDOS attacks?

A
  • Use globally distributed services like CF and R53
  • ELB to provide scale
  • Instance and environment scaling
  • Security groups and ACLs
40
Q

What protection do you get from using CF?

A
  • Inline inspection
  • Syn proxy protection
  • Slow read protection
  • Only valid HTTP/TCP packets

ag-Learn AWS (90 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions