Q14 — AWS SAA-C03 Ch.6
Question 14 of 65 | ← Chapter 6
Q379. A media company hosts its website on AWS. The website application's architecture includes a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB) and a database that is hosted on Amazon Aurora. The company's cybersecurity team reports that the application is vulnerable to SQL injection.How should the company resolve this issue?
- A. Use AWS WAF in front of the ALB. Associate the appropriate web ACLs with AWS WAF ✓
- B. Create an ALB listener rule to reply to SQL injections with a fixed response
- C. Subscribe to AWS Shield Advanced to block all SQL injection attempts automatically
- D. Set up Amazon Inspector to block all SQL injiection attempts automatically
Correct Answer: A. Use AWS WAF in front of the ALB. Associate the appropriate web ACLs with AWS WAF
Explanation
The correct option to resolve the SQL injection vulnerability is to use AWS WAF (Web Application Firewall) front of the ALB (Application Load Balancer) and associate the appropriate web ACLs (Access Control Lists) with AWS WAF.WAF helps protect web applications from common web exploits, including SQL injection attacks. By configuring AWS WAF with the appropriate web ACLs, you can define rules that inspect incoming requests and block any requests that match known SQL injection patterns. This helps prevent malicious SQL queries from reaching your application and compromising the database. Option B, creating an ALB listener rule reply to SQL injections with a fixed response, is not an effective solution as it only provides a response but does not prevent the SQL injection attack itself. Option C, subscribing to AWS Shield Advanced, is focused on DDoS (Distributed Denial of Service) protection and may not specifically address SQL injection vulnerabilities. Option D, setting up Amazon Inspector, a security assessment service that helps identify security vulnerabilities, including SQL injection, but it does not automatically block the attacks. It provides recommendations for remediation, but it's not a real-time protection mechanism like AWS WAF.