SOA-C02 Question 243
Select 2Your company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, the application has been targeted by malicious web traffic, including SQL injection and cross-site scripting (XSS) attacks. As a SysOps Administrator, you are tasked with configuring a solution to protect the application. Which combination of actions should you take to mitigate these threats?
- A
Enable AWS WAF on the Application Load Balancer and configure rules to block SQL injection and XSS attacks.
- B
Enable AWS Shield Standard to protect against DDoS attacks at the network and transport layers.
- C
Create a security group for the EC2 instances to block traffic on ports other than HTTP and HTTPS.
- D
Use AWS WAF to allow only trusted IP addresses to access the application.
- E
Enable AWS Shield Advanced for enhanced DDoS protection and access to detailed attack diagnostics.
Show answer and explanation
Correct answers: A, B
Explanation
The combination of AWS WAF and AWS Shield Standard is the most effective way to protect a web application from SQL injection, XSS, and DDoS attacks. AWS WAF enables you to configure rules specifically for web-based threats, while AWS Shield Standard provides automatic protection against DDoS attacks at the network and transport layers. Together, these services offer a comprehensive solution for securing applications hosted on AWS.
- A. Correct.
This is correct. AWS WAF is designed to protect web applications by filtering and blocking malicious web traffic such as SQL injection and XSS attacks. You can create custom rules or use managed rule sets to address these specific threats.
- B. Correct.
This is correct. AWS Shield Standard provides automatic protection against DDoS attacks, which is essential for securing your web application against such threats. While it doesn't specifically address SQL injection or XSS, it complements AWS WAF for overall protection.
- C. Incorrect.
This is incorrect. Security groups control inbound and outbound traffic at the instance level, but they do not have the capability to detect or block web-based attacks like SQL injection or XSS.
- D. Incorrect.
This is incorrect. While IP-based rules can be applied using AWS WAF, allowing only trusted IPs may not be a practical solution for most public-facing web applications and does not specifically address SQL injection or XSS.
- E. Incorrect.
This is incorrect. While AWS Shield Advanced provides enhanced DDoS protection, it is primarily focused on mitigating large-scale DDoS attacks and does not address web application-layer attacks such as SQL injection or XSS.