Q81 — AWS SAA-C03 Ch.15

Question 81 of 100 | ← Chapter 15

Q1181. A company uses Amazon API Gateway to manage REST APIs that third-party service providers access. The company must protect the REST APIs from SQL injection attacks and cross-site scripting attacks. The company wants to minimize changes to the architecture.Which solution will meet these requirements?

Correct Answer: B. Enable AWS WAF and configure web ACLs. Add the REST APIs as protected resources.

Explanation

To protect REST APIs managed by Amazon API Gateway from SQL injection attacks and cross-site scripting (XSS) attacks while minimizing changes to the architecture, the best solution is B. Enable AWS WAF and configure web ACLs. Add the REST APIs as protected resources.Analysis of Options:Option A: Activate AWS Shield Advanced. Configure Shield Advanced to operate in front of the REST APIs to inspect the inbound traffic.AWS Shield Advanced is primarily designed to protect against DDoS attacks. While it offers some protection against other types of attacks, it does not provide the specific rules needed to mitigate SQL injection and XSS attacks. Enabling Shield Advanced would not be the most effective solution for this requirement.Option B: Enable AWS WAF and configure web ACLs. Add the REST APIs as protected resources. AWS WAF is a web application firewall that helps protect web applications and APIs from common web exploits, including SQL injection and XSS attacks. By enabling AWS WAF and configuring web access control lists (ACLs) with rules to block SQL injection and XSS patterns, you can effectively protect the REST APIs. This solution requires minimal changes to the existing architecture, as AWS WAF can be easily integrated with Amazon API Gateway.Option C: Create an Amazon CloudFront distribution. Set each REST API as an origin. Configure AWS Shield to protect the CloudFront distribution.While using Amazon CloudFront can improve performance and provide some security benefits, configuring AWS Shield to protect the CloudFront distribution does not specifically address SQL injection and XSS attacks. AWS Shield is not designed to inspect and filter HTTP requests for these types of attacks at the application layer.Option D: Create an Amazon CloudFront distribution. Set each REST API as an origin. Create an AWS Lambda@Edge function to inspect inbound API traffic.While using AWS Lambda@Edge functions to inspect inbound traffic is a viable approach, it requires more development effort and changes to the architecture compared to enabling AWS WAF. AWS WAF provides pre-built rules for common web exploits, making it a more straightforward and efficient solution for this requirement.