SOA-C02 Question 244
Single answerYour organization hosts a web application on AWS using an Application Load Balancer (ALB) in front of multiple EC2 instances. The application has recently been targeted by malicious requests, including SQL injection and cross-site scripting (XSS) attacks. As a SysOps Administrator, you need to mitigate these threats while minimizing the impact on legitimate traffic. Which solution would best address this scenario?
- A
Enable AWS Shield Advanced to protect against SQL injection and XSS attacks.
- B
Use AWS WAF to create rules that block SQL injection and XSS patterns and associate it with the ALB.
- C
Configure security group rules on the EC2 instances to block traffic with SQL injection and XSS patterns.
- D
Enable VPC Flow Logs to monitor network traffic and block malicious requests targeting the application.
Show answer and explanation
Correct answer: B
Explanation
The best solution for mitigating SQL injection and XSS attacks is to use AWS WAF, as it is specifically designed to detect and block these types of web application threats. By associating AWS WAF with the Application Load Balancer, you can apply rules to inspect incoming traffic and block malicious requests while allowing legitimate traffic. Other options, such as AWS Shield Advanced or security groups, do not address the specific needs of this use case.
- A. Incorrect.
AWS Shield Advanced is designed for DDoS protection, but it does not include specific protections for threats like SQL injection or XSS. Therefore, this is not the best solution for the scenario.
- B. Correct.
AWS WAF allows you to define rules to block common web attack patterns such as SQL injection and XSS. By associating AWS WAF with the ALB, you can protect the application from these threats while still allowing legitimate traffic through. This is the correct answer.
- C. Incorrect.
Security groups are used to control inbound and outbound traffic at the instance level but cannot perform deep packet inspection or identify specific attack patterns like SQL injection or XSS. This makes them unsuitable for mitigating this type of attack.
- D. Incorrect.
VPC Flow Logs can help monitor network traffic and identify patterns but are not a preventive measure. They do not provide active protection against threats like SQL injection or XSS.