SAA-C03 Question 60
Select 3A company hosts a web application on Amazon EC2 behind an Application Load Balancer (ALB). The application has been experiencing an increased number of external threat vectors, including DDoS attacks and SQL injection attempts. As a Solutions Architect, which actions should you recommend to mitigate these threats while minimizing administrative overhead?
- A
Enable AWS Shield Standard to protect against DDoS attacks.
- B
Use AWS WAF to create rules that block SQL injection attempts.
- C
Enable EC2 instance-based firewalls to filter incoming malicious traffic.
- D
Use Amazon GuardDuty to block malicious IP addresses in real-time.
- E
Integrate the ALB with AWS WAF for application layer threat protection.
Show answer and explanation
Correct answers: A, B, E
Explanation
To mitigate external threat vectors like DDoS and SQL injection, AWS provides managed services that minimize administrative overhead while offering robust protection. AWS Shield Standard protects against DDoS attacks at no additional cost for all AWS customers. AWS WAF allows you to create rules to filter out specific types of malicious traffic, such as SQL injection attempts. By integrating AWS WAF with an Application Load Balancer, you can centralize protection for your application while maintaining scalability and ease of management. These solutions are cost-effective and align with AWS best practices for security.
- A. Correct.
AWS Shield Standard is automatically enabled for all AWS customers and provides protection against common DDoS attacks. This is a cost-effective option to mitigate such threats without additional configuration.
- B. Correct.
AWS WAF allows you to write custom rules that can block specific types of attacks, such as SQL injection, by inspecting incoming traffic patterns. This is a highly effective solution for mitigating application layer threats.
- C. Incorrect.
EC2 instance-based firewalls (via security groups) can filter traffic at the instance level, but they are not designed to inspect traffic for threats like SQL injection or DDoS attacks. This would require significant manual effort and is not the best practice for this scenario.
- D. Incorrect.
Amazon GuardDuty is a threat detection service that provides alerts based on malicious activity, but it does not block attacks in real-time. It is used for monitoring and alerting, not for actively mitigating threats.
- E. Correct.
Integrating the ALB with AWS WAF provides centralized application layer protection, allowing you to apply rules to filter malicious traffic before it reaches your backend instances. This is a recommended best practice.