SCS-C02 Question 185
Select 2Your company is hosting a web application on Amazon CloudFront backed by an Application Load Balancer (ALB). The security team has identified potential threats, including SQL injection and Cross-Site Scripting (XSS) attacks. They want to implement security controls at the edge to block malicious requests before they reach the application. What should you do to meet these requirements?
- A
Enable AWS WAF and configure rules to block SQL injection and XSS attacks.
- B
Enable AWS Shield Advanced to protect against SQL injection and XSS attacks.
- C
Configure AWS CloudFront with geo-restriction to block requests from specific countries.
- D
Use AWS Lambda@Edge to inspect incoming requests and block malicious traffic.
- E
Enable Amazon GuardDuty to detect SQL injection and XSS attacks in real time.
Show answer and explanation
Correct answers: A, D
Explanation
To address the identified threats (SQL injection and XSS), AWS WAF is the primary service designed to block such application-layer attacks by creating specific rules. Additionally, AWS Lambda@Edge can be used to implement custom request filtering logic at the edge, enhancing the security posture. While services like AWS Shield Advanced, GuardDuty, and geo-restriction provide other forms of protection, they do not directly mitigate SQL injection or XSS threats specifically.
- A. Correct.
Correct. AWS WAF can be used to create rules for identifying and blocking SQL injection and XSS attacks at the edge using pre-configured managed rules or custom rules.
- B. Incorrect.
Incorrect. AWS Shield Advanced is designed to protect against Distributed Denial of Service (DDoS) attacks, not specific application layer threats like SQL injection or XSS.
- C. Incorrect.
Incorrect. Geo-restriction in CloudFront can block traffic from certain geographic locations, but it does not address application-layer threats like SQL injection or XSS.
- D. Correct.
Correct. AWS Lambda@Edge allows you to write custom logic to inspect and filter requests at the edge. This can complement AWS WAF by providing customized security controls.
- E. Incorrect.
Incorrect. Amazon GuardDuty is a threat detection service that helps identify malicious activity in your AWS environment, but it does not block SQL injection or XSS attacks in real time.