Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A financial services firm hosts a customer-facing web application on AWS behind an Application Load Balancer (ALB). The security team needs to implement a solution to monitor for and automatically block SQL injection attacks at the application layer. Additionally, they must ensure that all administrative and management API actions across the entire AWS account are recorded and audited for regulatory compliance. Which combination of actions should a solutions architect recommend to meet these requirements?

  1. Deploy AWS WAF on the Application Load Balancer with a rule group to detect and block SQL injection attacks, and configure AWS CloudTrail with a multi-region trail to log all API activity to a secure Amazon S3 bucket.Answer
  2. B
    Enable AWS Shield Standard to inspect incoming requests and block SQL injection attacks on the Application Load Balancer, and enable AWS CloudTrail to log administrative API activity to an Amazon S3 bucket.
  3. C
    Deploy stateful rules in the subnet-level Network Access Control Lists (NACLs) to inspect HTTP payload content and block SQL injection traffic, and configure AWS Config to record all administrative API actions.
  4. D
    Deploy AWS WAF on the Application Load Balancer to mitigate SQL injection attacks, and use the AWS account root user credentials to configure a daily cron job that downloads and logs administrative activity.

Answer

Deploy AWS WAF on the Application Load Balancer with a rule group to detect and block SQL injection attacks, and configure AWS CloudTrail with a multi-region trail to log all API activity to a secure Amazon S3 bucket.
The correct answer combines AWS WAF, which inspects HTTP/S traffic at Layer 7 to block SQL injection attacks, with AWS CloudTrail, which logs API and management console activities for compliant security monitoring.

Step-by-Step Solution

1
Determine the correct service to monitor and mitigate Layer 7 application exploits.
AWS WAF is selected because it is designed to analyze HTTP payloads and block SQL injection attacks at the Application Load Balancer.
Other services like AWS Shield Standard or Network ACLs operate at network layers and cannot perform application payload inspection.
2
Select the appropriate compliance logging mechanism for AWS account administrative API activity.
AWS CloudTrail is chosen to record API calls and management events.
CloudTrail provides standard auditing logs for all management console, CLI, and SDK operations.
3
Combine into a secure, Well-Architected solution.
WAF is attached to the ALB, and a multi-region CloudTrail logs all API activity to a secure Amazon S3 bucket.
This guarantees real-time mitigation of application exploits and audit records stored securely for compliance.

Key Concept

Application-layer threat detection and compliance logging on AWS
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic