SAA-C03 Question 63
Select 2A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The web application has recently been targeted by a Distributed Denial of Service (DDoS) attack and SQL injection attempts. As a Solutions Architect, which combination of AWS services and configurations should you recommend to protect the application from these external threats?
- A
Configure AWS WAF (Web Application Firewall) with rules to block SQL injection attempts.
- B
Enable AWS Shield Advanced to protect against DDoS attacks.
- C
Use an Amazon S3 bucket to store the web application content and minimize attack surface.
- D
Enable VPC Flow Logs to monitor network traffic and identify malicious activity.
- E
Configure Security Groups and Network ACLs to block specific IPs identified as malicious.
Show answer and explanation
Correct answers: A, B
Explanation
To protect against external threats like DDoS and SQL injection, AWS Shield Advanced and AWS WAF are the recommended services. AWS Shield Advanced provides comprehensive DDoS protection, while AWS WAF enables application-layer security through custom or managed rules. Other options like VPC Flow Logs, Security Groups, and using S3 address different aspects of security but do not directly mitigate these specific threats.
- A. Correct.
This is correct. AWS WAF can be configured with managed or custom rules to block SQL injection and other application-layer attacks.
- B. Correct.
This is correct. AWS Shield Advanced provides enhanced protection against DDoS attacks and includes features like cost protection and advanced monitoring.
- C. Incorrect.
This is incorrect. While using S3 for static web hosting can reduce exposure, it does not protect against threats like DDoS or SQL injection that target application-layer vulnerabilities.
- D. Incorrect.
This is incorrect. VPC Flow Logs are primarily used for monitoring and logging network traffic but do not actively protect against external threats like DDoS or SQL injection.
- E. Incorrect.
This is incorrect. Security Groups and Network ACLs can block specific IPs but are not effective as a primary defense against large-scale DDoS attacks or SQL injection, which typically involve dynamic or distributed IP sources.