A multinational banking institute is using AWS infrastructure for deploying its application servers. A new application is being developed on a fleet of EC2 servers in VPC spread across multiple AZ & will be having ALB in the front-end. Global users would be accessing this banking application which needs to be highly secure & high-performance. The security team is concerned about the security of this application & needs a new solution to mitigate DDoS attacks.
Which of the following solutions will meet the requirement?

Answer options:

A.Create an internal ALB in a VPC with an internet gateway attached & without any Public IP address assigned to it. Associate ALB as an endpoint in AWS Global Accelerator.
B.Create an internal ALB in a VPC with an internet gateway attached & with Public IP address assigned to it. Associate ALB as an endpoint in AWS Global Accelerator.
C.Create an internal ALB in a VPC without an internet gateway attached & with an Elastic IP address assigned to ALB. Associate ALB as an endpoint in AWS Global Accelerator.
D.Create an internal ALB in a VPC without an internet gateway attached & a Private IP address assigned to ALB. Associate ALB as an endpoint in AWS Global Accelerator.

Correct Answer – A
When ALB is used as an endpoint for AWS Global Accelerator, all traffic towards this endpoint flows over AWS Global Accelerator. For this, a public IP address is not required to be assigned to ALB, but an internet gateway is required to be attached to VPC to indicate internet traffic is accepted in this VPC.With Internet traffic flowing only via a single-entry point of AWS Global Accelerator, it will help reduce DDoS attacks.
Option B is incorrect as with internal ALB used as an endpoint for AWS Global Accelerator, Public IP is not required to be assigned to ALB.Options C & D are incorrect as Internet Gateway needs to be attached to VPC with an internal ALB created.
For more information on Secure VPC connections in AWS Global Accelerator, refer to the following URL
https://docs.aws.amazon.com/global-accelerator/latest/dg/secure-vpc-connections.html