SAP-C02 Question 248
Select 2An e-commerce company is experiencing a significant increase in malicious traffic targeting their web application. The application runs behind an Application Load Balancer (ALB) and uses Amazon CloudFront for content delivery. The company wants to mitigate these threats while minimizing the administrative overhead of constantly updating rules. Which combination of AWS managed security services should the company use to address this issue?
- A
AWS WAF with managed rule groups
- B
AWS Shield Advanced for DDoS protection
- C
Amazon GuardDuty to identify the source of malicious activity
- D
AWS Security Hub to set up compliance standards for the application
- E
Amazon Macie to detect sensitive data within the application
Show answer and explanation
Correct answers: A, B
Explanation
To mitigate malicious traffic targeting a web application, AWS WAF with managed rule groups and AWS Shield Advanced are the most appropriate services. AWS WAF provides protection against common web exploits and bots using managed rules, which reduces the need for constant updates. AWS Shield Advanced adds critical DDoS protection, ensuring availability during large-scale attacks. While services like Amazon GuardDuty, AWS Security Hub, and Amazon Macie are valuable for security and compliance, they do not directly address the issue of blocking malicious traffic targeting the application.
- A. Correct.
AWS WAF with managed rule groups is designed to protect web applications by automatically updating rules to block known attack patterns, such as SQL injection and cross-site scripting. This helps mitigate malicious traffic while reducing administrative overhead.
- B. Correct.
AWS Shield Advanced provides enhanced protection against DDoS attacks, which is critical for an e-commerce application experiencing increased malicious traffic. It also offers 24/7 access to the AWS DDoS Response Team (DRT).
- C. Incorrect.
Amazon GuardDuty is primarily a threat detection service for monitoring unusual activity across AWS accounts and workloads, but it does not actively block malicious traffic targeting a web application.
- D. Incorrect.
AWS Security Hub is a central service for compliance and security posture management, but it does not directly mitigate or block malicious web traffic.
- E. Incorrect.
Amazon Macie is a data security service focused on identifying sensitive data, such as PII, but it does not offer protection against malicious traffic targeting web applications.