SAP-C02 Question 249
Select 2A company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is experiencing frequent malicious attacks such as SQL injection and Distributed Denial of Service (DDoS). The company wants to implement a managed security solution to protect the application without significant operational overhead. Which combination of AWS managed services should the company use to address these concerns?
- A
AWS WAF to filter malicious web requests and AWS Shield Advanced to protect against DDoS attacks
- B
Amazon GuardDuty to monitor traffic and AWS Security Hub to remediate identified threats
- C
AWS WAF to prevent SQL injection attacks and Amazon GuardDuty to identify and block DDoS attacks
- D
AWS Shield Advanced to protect against DDoS attacks and AWS Security Hub to aggregate security findings
Show answer and explanation
Correct answers: A, D
Explanation
To protect the web application from SQL injection and DDoS attacks, the company should use AWS WAF to filter malicious web requests and AWS Shield Advanced for DDoS protection. These services are managed by AWS, reducing operational overhead while addressing the specific security concerns. Other services like Amazon GuardDuty and AWS Security Hub are complementary but do not directly prevent or mitigate these types of attacks.
- A. Correct.
AWS WAF can be used to create rules to filter malicious web requests, such as SQL injection attempts, while AWS Shield Advanced provides enhanced DDoS protection. This is the correct combination for the scenario.
- B. Incorrect.
Amazon GuardDuty is a threat detection service that monitors for malicious activity, but it cannot directly remediate threats or protect against DDoS attacks. AWS Security Hub aggregates security findings but does not actively prevent attacks.
- C. Incorrect.
While AWS WAF can prevent SQL injection attacks, Amazon GuardDuty is not designed to block DDoS attacks. Instead, it provides threat detection and monitoring.
- D. Correct.
AWS Shield Advanced offers robust protection against DDoS attacks, and AWS Security Hub aggregates security findings to provide a centralized view. However, AWS Security Hub does not directly filter or block malicious requests, so it is not sufficient by itself.