SOA-C02 Question 241
Select 2Your company runs a web application behind an Application Load Balancer (ALB) in AWS. Recently, your application has been subjected to SQL injection and DDoS attacks. As a SysOps Administrator, you are tasked with implementing a solution that protects against both threats. Which combination of AWS services should you configure to address these issues?
- A
AWS WAF with rules to block SQL injection patterns
- B
AWS Shield Advanced for DDoS protection
- C
Enable AWS Trusted Advisor to monitor for DDoS attacks
- D
Configure an Amazon VPC Network ACL to block SQL injection traffic
- E
Enable ELB logging to detect and block malicious traffic
Show answer and explanation
Correct answers: A, B
Explanation
To protect against SQL injection and DDoS attacks, AWS WAF should be used to block malicious request patterns such as SQL injection, while AWS Shield Advanced provides managed DDoS protection. Combining these two services ensures comprehensive protection for the application. Other options, like Trusted Advisor or logging, provide monitoring and insights but do not actively mitigate these specific threats.
- A. Correct.
Correct: AWS WAF (Web Application Firewall) allows you to create rules to block specific attack patterns, such as SQL injection. It is the appropriate service for protecting against SQL injection attacks.
- B. Correct.
Correct: AWS Shield Advanced provides managed protection against DDoS attacks, including advanced mitigation strategies, making it suitable for addressing DDoS threats.
- C. Incorrect.
Incorrect: AWS Trusted Advisor provides recommendations for cost optimization, performance, and security best practices but does not actively prevent DDoS attacks.
- D. Incorrect.
Incorrect: While Network ACLs can block traffic based on IP or port, they cannot analyze traffic for SQL injection patterns. AWS WAF is the proper tool for this purpose.
- E. Incorrect.
Incorrect: ELB logging provides visibility into traffic but does not have the capability to block or mitigate malicious traffic. It is more of a diagnostic tool than a protective measure.