Q86 — AWS SAA-C03 Ch.10

Question 86 of 100 | ← Chapter 10

Q686. A company has deployed its application on Amazon EC2 instances with an Amazon RDS database. The company used the principle of least privilege to configure the database access credentials. The company's security team wants to protect the application and the database from SQL injection and other web-based attacks.Which solution will meet these requirements with the LEAST operational overhead?

• A. Use security groups and network ACLs to secure the database and application servers
• B. Use AWS WAF to protect the application. Use RDS parameter groups to configure the security settings ✓
• C. Use AWS Network Firewall to protect the application and the database
• D. Use different database accounts in the application code for different functions. Avoid granting excessive privileges to the database users

Correct Answer: B. Use AWS WAF to protect the application. Use RDS parameter groups to configure the security settings

Explanation

To meet the requirements of protecting the application and the database from SQL injection and other web-based attacks with the LEAST operational overhead, the most suitable solution is:B. Use AWS WAF (Web Application Firewall) to protect the application. Use RDS parameter groups to configure the security settings.Explanation:A. Use security groups and network ACLs to secure the database and application servers: While this helps secure the network layer, it does not specifically address SQL injection or web-based attacks targeting the application layer. Security groups and network ACLs are good for controlling access to EC2 instances and RDS instances at the network level, but they don't protect against application-level attacks like SQL injection.B. Use AWS WAF to protect the application. Use RDS parameter groups to configure the security settings: AWS WAF is specifically designed to protect web applications from common web exploits and attacks that could affect application availability, compromise security, or consume excessive resources. It allows for custom rules that can block or allow traffic based on conditions you define, making it an effective tool against SQL injection and other web-based attacks. Additionally, RDS parameter groups can be used to tune RDS instances' settings to improve security, but their primary purpose isn't directly related to preventing SQL injection attacks. However, in combination with WAF, this approach addresses both application-level and database-level concerns with minimal operational overhead.C. Use AWS Network Firewall to protect the application and the database: AWS Network Firewall is a managed firewall and network security service that makes it easier to deploy firewall rules and manage network traffic flow in AWS Virtual Private Clouds (VPCs). However, like security groups and network ACLs, it operates at the network layer and does not address application-level vulnerabilities like SQL injection.D. Use different database accounts in the application code for different functions. Avoid granting excessive privileges to the database users: This is a good security practice and helps follow the principle of least privilege, but it doesn't directly address the need to protect the application from SQL injection or other web-based attacks. This approach reduces the risk of data breaches due to compromised database credentials but does not address vulnerabilities in the application layer.