DOP-C02 Question 382
Select 2Your organization hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a public subnet. Recently, your security team identified an increase in malicious traffic, including SQL injection and cross-site scripting (XSS) attacks, targeting the application. As the DevOps engineer, you need to implement a solution to mitigate these threats while allowing only legitimate traffic to reach the application. Which combination of actions should you take to address this issue?
- A
Attach an AWS WAF web ACL to the Application Load Balancer with rules to block SQL injection and XSS attacks.
- B
Configure security groups on the EC2 instances to allow only HTTP and HTTPS traffic from known IP addresses.
- C
Enable AWS Shield Advanced for the Application Load Balancer to protect against DDoS attacks.
- D
Add a rule to the Network ACL of the public subnet to block traffic from suspicious IP addresses.
- E
Move the Application Load Balancer to a private subnet to prevent direct internet access.
Show answer and explanation
Correct answers: A, C
Explanation
To mitigate SQL injection and XSS attacks, the most effective solution is to use AWS WAF, which allows you to define specific rules to block these attack patterns. Additionally, enabling AWS Shield Advanced adds resilience against DDoS attacks that may accompany such threats. Security groups and Network ACLs are useful for basic network access control but cannot directly address application-layer attacks like SQL injection or XSS. Moving the ALB to a private subnet would disrupt legitimate access, making it an impractical choice.
- A. Correct.
Attaching an AWS WAF web ACL to the Application Load Balancer allows you to define rules to filter traffic and block specific attack patterns such as SQL injection and XSS. This directly addresses the malicious traffic issue.
- B. Incorrect.
While security groups can restrict access to specific sources, relying solely on known IP addresses may not be feasible for a public-facing web application, especially when the malicious traffic is coming from dynamic or unknown IPs.
- C. Correct.
Enabling AWS Shield Advanced provides additional protection against DDoS attacks, which may accompany other threats such as SQL injection. While this doesn't mitigate SQL injection or XSS directly, it enhances the security posture against broader attack vectors.
- D. Incorrect.
Adding rules to the Network ACL to block suspicious IP addresses can help in some cases, but this is not a scalable or comprehensive solution for mitigating SQL injection and XSS attacks, as these attacks often originate from a wide range of IPs.
- E. Incorrect.
Moving the Application Load Balancer to a private subnet would prevent legitimate traffic from reaching the web application. This is not a viable solution for a public-facing application.