SCS-C02 Question 499
Select 2Your company is deploying a new web application on AWS. To minimize the attack surface of the application, which of the following strategies should you implement? (Select TWO.)
- A
Use AWS WAF to block common web-based attack patterns, such as SQL injection and cross-site scripting (XSS).
- B
Deploy the application in a public subnet to allow direct internet access for all components.
- C
Enable and enforce the principle of least privilege for IAM roles associated with the application.
- D
Allow unrestricted inbound traffic to the application’s Amazon EC2 instances for scalability.
- E
Use AWS Systems Manager to patch and update the underlying operating system of the application instances.
Show answer and explanation
Correct answers: A, C
Explanation
Reducing the attack surface involves limiting exposure to potential threats. Using AWS WAF provides a protective layer against common attacks, and enforcing the principle of least privilege ensures minimal permissions are granted, reducing the likelihood of misuse or compromise. These combined strategies significantly reduce the application’s attack surface.
- A. Correct.
Using AWS WAF helps reduce the attack surface by blocking common web-based attack patterns, such as SQL injection and XSS. This adds a layer of protection to your application.
- B. Incorrect.
Deploying the application in a public subnet increases the attack surface since all components are exposed to the internet. This is not a recommended security practice.
- C. Correct.
Enforcing the principle of least privilege ensures that application components and users only have the permissions they absolutely need, reducing the potential impact of a compromised identity.
- D. Incorrect.
Allowing unrestricted inbound traffic significantly increases the attack surface by making the application instances accessible to potential attackers. This is not a secure approach.
- E. Incorrect.
While patching and updating the operating system is a good practice for security, it is not directly related to reducing the attack surface. It focuses on mitigating vulnerabilities after deployment.