SCS-C02 Question 34
Select 2You are responsible for securing an application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses Amazon RDS for its database and stores sensitive customer data. During a security audit, it was identified that the application is vulnerable to SQL injection attacks. Which of the following steps should you take to mitigate this vulnerability and improve the application's security posture?
- A
Enable AWS WAF on the Application Load Balancer and configure a rule to block SQL injection attempts.
- B
Configure an NACL (Network Access Control List) to block SQL injection patterns at the subnet level.
- C
Utilize parameterized queries or prepared statements in the application code to prevent SQL injection.
- D
Enable database encryption using AWS KMS to secure sensitive data in transit.
- E
Implement IAM policies to restrict access to the RDS database.
Show answer and explanation
Correct answers: A, C
Explanation
SQL injection is an application-layer vulnerability, so the appropriate mitigation measures involve inspecting and sanitizing application traffic and inputs. Enabling AWS WAF on the ALB allows for blocking SQL injection attempts at the web layer. Additionally, using parameterized queries or prepared statements in the application code ensures proper handling of user inputs, effectively preventing SQL injection attacks. Network-level controls (like NACLs) and IAM policies do not address SQL injection directly, and database encryption focuses on securing data at rest, not on preventing application vulnerabilities.
- A. Correct.
Correct. AWS WAF can be used to inspect and block malicious traffic, including SQL injection attempts, at the Application Load Balancer level.
- B. Incorrect.
Incorrect. NACLs operate at the network layer and cannot inspect or block specific SQL injection patterns in application traffic.
- C. Correct.
Correct. Using parameterized queries or prepared statements in the application code ensures that user inputs are properly sanitized, mitigating SQL injection risks.
- D. Incorrect.
Incorrect. While database encryption is important for securing data at rest, it does not address SQL injection attacks.
- E. Incorrect.
Incorrect. IAM policies control access to AWS resources but do not defend against application-layer vulnerabilities like SQL injection.