A SysOps administrator is tasked with protecting a regional Amazon API Gateway endpoint from SQL injection attacks using AWS WAF. Which actions must the administrator perform to achieve this security objective? (Select TWO.)
- Create a regional Web Access Control List (Web ACL) and add a rule statement that inspects for SQL injection patterns.Answer
- Associate the regional Web ACL with the specific Amazon API Gateway stage.Answer
- CConfigure an inbound Network Access Control List (NACL) rule on the subnet to block SQL injection while restricting outbound traffic to ports 80 and 443 only.
- DCreate an IAM role allowing API Gateway to invoke AWS WAF, ensuring the administrator's IAM policy has assume role permissions but omitting the pass role permission.
- EConfigure the API Gateway to route traffic to a subnet that has had its Internet Gateway route removed from the subnet's route table.
Answer
Create a regional Web Access Control List (Web ACL) with a rule statement that inspects for SQL injection patterns, and associate this Web ACL with the specific Amazon API Gateway stage.
To protect a regional Amazon API Gateway stage, the SysOps administrator must create a regional Web Access Control List (Web ACL) in AWS WAF that contains a rule statement to inspect request payloads for SQL injection patterns, and then associate that Web ACL directly with the API Gateway stage. AWS WAF functions at layer 7 to inspect and filter incoming traffic based on configured rules.
Step-by-Step Solution
Key Concept
AWS WAF protects API Gateway stages by using regional Web ACLs containing rule statements that inspect HTTP/S request components for SQL injection attacks.
Estimated Time:1m 0s