A multiplayer game studio launches a global leaderboard API on an ALB with login and matchmaking. Threat modeling anticipates UDP volumetric floods, Layer 7 fake-client bots inflating scores, and SQL injection on login. Investors require always-on mitigation with low latency and automatic burst scaling at the edge. Which edge security strategy should the architect select to counter the anticipated volumetric, bot, and injection threats?
Select an answer to reveal the explanation.
Short Explanation
You're juggling network tsunamis and sneaky score-cheating bots at once, so you need layered edge muscle. You'll win with CloudFront plus Shield-Advanced and WAF working together like bouncer and ID checker.
Full Explanation
The correct edge strategy combines CloudFront in front of the ALB with Shield Advanced and WAF Bot Control, SQLi rules and rate limiting because it maps to all stated threats and constraints: CloudFront gives global edge termination, low-latency caching and automatic burst absorption, Shield Advanced gives always-on volumetric protection with enhanced detection, Bot Control adds behavioral analysis for fake game clients, SQLi rules inspect login payloads for injection patterns, and rate limiting contains floods and score-spam. The CloudFront variant relying on aggressive rate limiting for login inputs fails on injection because throttling velocity never inspects bodies and query strings, so low-and-slow SQL payloads still pass. The CloudFront variant relying on reputation-based IP blocking fails on bots because IP lists only block known bad addresses and cannot detect distributed fake clients that rotate IPs and mimic legitimate sessions without Bot Control heuristics. The ALB-direct variant fails on architecture because even with full WAF coverage it centralizes traffic at the origin without edge offload, sacrificing mandated low latency and transparent burst scaling and leaving the origin more exposed. Exam caveat is to separate availability controls from payload-inspection controls and edge distribution from origin protection, as names sound overlapping under pressure. Practical check is to run WAF in count mode first, verify Bot Control, SQLi and rate-limit matches in sampled requests and CloudWatch, then enforce blocking and load-test leaderboard bursts via CloudFront to confirm cache performance and origin latency.