Examkin

Question

Difficulty: EasyEdge and DDoS Protection

A real estate company is hosting its public property search portal on AWS. The company needs to protect the application from common web exploits and vulnerabilities, such as SQL injection and cross-site scripting (XSS), which are affecting database queries and user sessions. Which AWS service should a solutions architect recommend to meet this requirement?

  1. AWS WAFAnswer
  2. B
    AWS Shield Standard
  3. C
    Network Access Control Lists (NACLs)
  4. D
    Security Groups

Answer

AWS WAF is the correct service because it functions at the application layer (Layer 7) and can inspect HTTP/HTTPS request bodies, headers, and query strings to block malicious payloads such as SQL injection and cross-site scripting (XSS) attacks.
AWS WAF is the appropriate service because it inspects incoming HTTP/HTTPS requests at the application layer (Layer 7) and blocks threats like SQL injection and cross-site scripting based on customizable rules.

Step-by-Step Solution

1
Identify the target threat layer and exploit types described in the scenario.
The target threats are SQL injection and cross-site scripting (XSS), which are application-layer (Layer 7) exploits.
Understanding the OSI model layer of the threat helps eliminate services that only operate at lower layers.
2
Evaluate the capabilities of the available security services relative to Layer 7 inspection.
AWS WAF is the only service listed that operates at Layer 7 and is capable of inspecting HTTP/HTTPS request components like query parameters and request bodies.
Security Groups and Network ACLs filter traffic based on IP addresses and ports (Layer 3 and 4), while AWS Shield Standard mitigates infrastructure-layer DDoS attacks (Layer 3 and 4).
3
Select the service designed specifically for mitigating Layer 7 application exploits.
AWS WAF is recommended for web application-layer exploit protection.
Deploying AWS WAF allows the application of rules to inspect and block malicious web requests before they reach the backend application.

Key Concept

AWS WAF operates at Layer 7 to protect web applications against common web exploits, whereas AWS Shield, Security Groups, and NACLs operate at Layers 3 and 4.
Estimated Time:45s
Rate this question

Topics

Edge and DDoS Protection

More questions from this topic