SAA-C03 Question 61
Select 2A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is accessible publicly, and the company is concerned about potential external threats like DDoS attacks and SQL injection. What steps should the company take to mitigate these threats?
- A
Use AWS Shield Standard to protect against DDoS attacks.
- B
Enable AWS WAF on the ALB to create rules blocking SQL injection attempts.
- C
Launch the application in a private subnet to block all public traffic.
- D
Configure Amazon GuardDuty to detect potential threats and send alerts.
- E
Use Security Groups to block traffic from known malicious IP addresses.
Show answer and explanation
Correct answers: A, B
Explanation
To mitigate external threats like DDoS attacks and SQL injection, AWS provides specialized tools such as AWS Shield and AWS WAF. AWS Shield Standard is included by default and helps protect against DDoS attacks, while AWS WAF enables you to create custom rules to detect and block malicious traffic, such as SQL injection attempts. Other options, such as using GuardDuty or Security Groups, are helpful for monitoring or controlling traffic but are not comprehensive solutions for these specific threats.
- A. Correct.
Correct. AWS Shield Standard provides automatic protection against common DDoS attacks at no additional cost and is ideal for public-facing resources like ALBs.
- B. Correct.
Correct. AWS WAF integrates with ALBs and can be used to define rules to block SQL injection attempts or other malicious traffic patterns.
- C. Incorrect.
Incorrect. Hosting the application in a private subnet would block all public access, making the application inaccessible to legitimate users.
- D. Incorrect.
Incorrect. Amazon GuardDuty is a threat detection service, but it does not directly mitigate DDoS or SQL injection. It is used for monitoring and alerting, not active protection.
- E. Incorrect.
Incorrect. Security Groups can control inbound and outbound traffic, but they are not effective against advanced threats like DDoS or SQL injection.