Q14 — AWS SAA-C03 Ch.17

Question 14 of 89 | ← Chapter 17

Q1314. A solutions architect is designing a scalable web application that runs on Amazon EC2. The application users must stay on the same server after login. The application must be protected from common exploits.Which solution will meet these requirements?

Correct Answer: C. Create an Application Load Balancer(ALB) with a target group. Attach the target group to an Auto Scaling group. Enable application-based stickiness on the target group. Associate the ALB with an AWS WAF web ACL.

Explanation

The correct solution to meet the requirements of user stickiness after login and protection from common exploits is:C. Create an Application Load Balancer (ALB) with a target group. Attach the target group to an Auto Scaling group. Enable application-based stickiness on the target group. Associate the ALB with an AWS WAF web ACL.Why Option C is Correct:User Stickiness After Login (Session Persistence)Application Load Balancer (ALB) supports application-based stickiness (using cookies) to ensure users remain connected to the same EC2 instance after login.Duration-based stickiness (Option A) is less ideal because it relies on a fixed timeout, which may not align with actual session durations.Network Load Balancer (NLB) (Options B & D) does not support cookie-based stickiness--it only supports IP-based stickiness, which is less reliable for web applications (users may change IPs).Protection from Common ExploitsAWS WAF (Web Application Firewall) integrates with ALB to block common web exploits (e.g., SQL injection, XSS, CSRF) using pre-configured rules (e.g., OWASP Top 10 protections). AWS Network Firewall (Options A & D) operates at Layer 3/4 (network/transport) and is better suited for protecting VPCs from DDoS or port scanning, not application-layer attacks.Scalability & Auto ScalingThe ALB target group is attached to an Auto Scaling group, ensuring the application scales dynamically based on traffic while maintaining stickiness.Why Other Options Are Incorrect:A. ALB with Duration-Based Stickiness + AWS Network Firewall Duration-based stickiness may force users to switch servers even if their session is active (e.g., if the timeout is too short).AWS Network Firewall does not protect against application-layer attacks like SQL injection.B. NLB with AWS WAF Web ACLNLB does not support cookie-based stickiness, making session persistence unreliable for web apps. While AWS WAF can be associated with an NLB, it is less common (WAF is typically used with ALB/ CloudFront for HTTP/HTTPS traffic).D. NLB with Target Group Stickiness + AWS Network FirewallNLB's IP-based stickiness is not ideal for web sessions (users may change IPs).AWS Network Firewall lacks application-layer protection.Implementation Steps for Option C:Deploy an ALBCreate an Application Load Balancer in a public subnet.Configure listeners (e.g., HTTP/HTTPS) and target groups (pointing to EC2 instances).Enable Application-Based StickinessIn the target group settings, select "Enable application-based stickiness". Choose "AWSALB" (default ALB cookie) or a custom cookie name. Set an appropriate TTL (e.g., 1 hour, aligned with session timeout).Associate AWS WAFCreate a Web ACL in AWS WAF with rules to block common exploits (e.g., SQLi, XSS, SizeConstraints).Attach the Web ACL to the ALB listener.Set Up Auto ScalingCreate an Auto Scaling group with EC2 instances running the web application. Configure scaling policies (e.g., target tracking for CPU utilization).Attach the ASG to the ALB target group.Key Considerations:Cookie Security: Use secure, HTTP-only cookies to prevent XSS attacks. Session Replication: If using a distributed application (e.g., Tomcat), enable session replication or store sessions in Amazon ElastiCache (Redis).WAF Rule Management: Regularly update the WAF Web ACL with the latest AWS Managed Rules (e.g., AWSManagedRulesCommonRuleSet).Conclusion:Option C is the best solution because it combines reliable session persistence (application-based stickiness) with application-layer protection (AWS WAF), ensuring both user continuity and security.