DOP-C02 Question 379
Single answerYour company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is accessible via HTTPS and serves customers globally. Recently, the application has been targeted by a large number of malicious requests that attempt SQL injection attacks. To mitigate this, you need to implement a security solution that protects the application while minimizing operational overhead. Which solution would best address this requirement?
- A
Configure AWS WAF with a managed rule group to block SQL injection attempts and associate it with the Application Load Balancer.
- B
Create Security Group rules to block incoming traffic from suspicious IP addresses identified in the application logs.
- C
Deploy AWS Shield Advanced to automatically detect and block SQL injection attacks.
- D
Use an Amazon VPC Network ACL to block incoming traffic on port 443 from untrusted IP ranges.
Show answer and explanation
Correct answer: A
Explanation
The best solution for mitigating SQL injection attacks is to use AWS WAF with a managed rule group. AWS WAF can inspect HTTP/S requests and block malicious patterns like SQL injection attempts. By associating the WAF rule with the Application Load Balancer, you ensure that these attacks are mitigated at the edge, reducing the risk to your application while minimizing operational complexity. Other options, such as Security Groups and Network ACLs, are not suitable for application-layer protection, and AWS Shield Advanced is designed for DDoS protection rather than addressing threats like SQL injection.
- A. Correct.
This is the correct answer. AWS WAF allows you to protect web applications by defining rules that block common attack patterns, such as SQL injection. Using a managed rule group is efficient, as it provides preconfigured rules to address such threats. Associating it with the ALB ensures the protection is applied before requests reach the backend servers.
- B. Incorrect.
While Security Groups are essential for controlling inbound and outbound traffic at the instance level, they are not designed to inspect and block application-layer attacks like SQL injection. This option would not provide sufficient protection in this scenario.
- C. Incorrect.
AWS Shield Advanced is primarily designed to protect against Distributed Denial of Service (DDoS) attacks. It does not specifically address application-layer threats like SQL injection.
- D. Incorrect.
Network ACLs operate at the subnet level and control traffic based on IP addresses and ports. They cannot inspect or block application-layer threats such as SQL injection, making this option ineffective for the given scenario.