SCS-C02 Question 81
Single answerYour organization has recently deployed an application running on Amazon EC2 instances behind an Application Load Balancer (ALB). As part of compliance requirements, you need to monitor and analyze all incoming requests to the ALB to detect potential security threats such as SQL injection and unauthorized access attempts. Which solution provides the most effective and scalable way to achieve this?
- A
Enable ALB access logging and store the logs in an Amazon S3 bucket for analysis.
- B
Use AWS WAF in conjunction with the ALB to monitor and block malicious traffic.
- C
Enable CloudTrail logging for the ALB and analyze the logs for suspicious activity.
- D
Deploy a third-party network monitoring appliance in the VPC to analyze traffic to the ALB.
Show answer and explanation
Correct answer: B
Explanation
AWS WAF is specifically designed to monitor and block malicious traffic in real-time. When used with an Application Load Balancer, it enables you to detect and mitigate threats like SQL injection and unauthorized access attempts efficiently. Other options, such as ALB access logging or CloudTrail, are useful for logging and analysis but do not provide active threat mitigation.
- A. Incorrect.
While enabling ALB access logging provides detailed information about requests, it does not actively monitor or block malicious traffic in real-time. This is a good step for post-incident analysis but not the most effective option for detecting and mitigating threats proactively.
- B. Correct.
AWS WAF (Web Application Firewall) allows you to define rules to monitor and block malicious patterns, such as SQL injection or cross-site scripting, in real-time. It integrates seamlessly with the ALB, making it the most effective and scalable solution for detecting and mitigating security threats.
- C. Incorrect.
CloudTrail is primarily used for logging API activity in your AWS account. It does not provide detailed information about incoming requests to the ALB, nor does it actively monitor or block threats.
- D. Incorrect.
While deploying a third-party monitoring appliance might provide some level of visibility, it introduces additional complexity, cost, and scaling challenges. AWS native services like WAF are better suited for this use case.