SAA-C03 Question 384
Single answerA company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores user-uploaded files in an Amazon S3 bucket. Recently, the company noticed that some users are uploading malicious files. How can the company prevent this while minimizing operational overhead?
- A
Use Amazon GuardDuty to scan files in the S3 bucket for malicious content.
- B
Configure an AWS WAF rule to block malicious files during upload.
- C
Use an S3 Object Lambda function to scan files for malware before they are stored.
- D
Integrate the S3 bucket with Amazon Macie to detect and block malicious files.
Show answer and explanation
Correct answer: C
Explanation
To prevent malicious files from being uploaded to an S3 bucket, you need a mechanism to inspect files as they are being uploaded. S3 Object Lambda allows for custom processing of uploaded objects, such as malware scanning, ensuring the files meet the required security standards. GuardDuty, WAF, and Macie do not provide direct file scanning capabilities for this use case.
- A. Incorrect.
Amazon GuardDuty is a threat detection service that monitors for malicious activity but does not scan files in S3 for malware.
- B. Incorrect.
AWS WAF is primarily used to protect web applications from common web exploits and does not scan files during upload.
- C. Correct.
Using an S3 Object Lambda function allows you to process files during upload, including scanning them for malware, which addresses the issue directly.
- D. Incorrect.
Amazon Macie is a data discovery and data classification service focused on identifying sensitive data, not detecting or blocking malicious files.