SOA-C02 Question 242
Select 3Your company hosts a web application on an Amazon CloudFront distribution fronting an Application Load Balancer (ALB) and EC2 instances. The application has been experiencing suspicious activity, including SQL injection attempts and excessive requests from specific IP addresses, causing performance degradation. As a SysOps Administrator, which combination of actions should you take to protect the application using AWS network protection services?
- A
Create an AWS WAF WebACL and associate it with the CloudFront distribution to block SQL injection patterns.
- B
Enable AWS Shield Advanced for the CloudFront distribution to mitigate large-scale DDoS attacks.
- C
Use Amazon GuardDuty to automatically block malicious traffic targeting the application.
- D
Configure rate-based rules in AWS WAF to limit the number of requests from specific IPs.
- E
Add a custom rule in the security group associated with the ALB to block traffic from the suspicious IP addresses.
Show answer and explanation
Correct answers: A, B, D
Explanation
To mitigate SQL injection attempts and control excessive requests, using AWS WAF with WebACLs and rate-based rules is the best approach. Additionally, enabling AWS Shield Advanced ensures comprehensive protection against DDoS attacks. While GuardDuty provides threat detection, it does not directly block traffic, and security groups are not designed for application-layer protection.
- A. Correct.
Correct. AWS WAF WebACLs can detect and block SQL injection patterns by using managed rules or custom rules, and associating the WebACL with CloudFront ensures protection at the edge.
- B. Correct.
Correct. AWS Shield Advanced provides enhanced DDoS protection and monitoring for CloudFront distributions and other AWS resources.
- C. Incorrect.
Incorrect. GuardDuty is a threat detection service, not a network protection service. It does not directly block traffic but provides findings that can inform protection actions.
- D. Correct.
Correct. Rate-based rules in AWS WAF allow you to throttle excessive requests from specific IPs, mitigating potential abuse.
- E. Incorrect.
Incorrect. Security groups are stateful and operate at the instance level, not at the application or CloudFront level. They are not suitable for blocking traffic at the edge or managing application-layer attacks.