Exams / SAA-C03 / Edge protection with AWS WAF and Shield / Question 1
SAA-C03 practice question: Edge protection with AWS WAF and Shield
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
An online ticketing company runs its public booking site on Amazon EC2 instances behind an Application Load Balancer. Logs show automated clients sending SQL injection payloads in query strings, and single IP addresses sending thousands of requests within a few minutes when tickets go on sale. The company wants to block both kinds of traffic before it reaches the instances, using managed protections where possible, without blocking normal customers. Which solution meets these requirements?
Choose one answer.
- AA. Associate an AWS WAF web ACL with the load balancer that uses the AWS managed SQL database rule group and a rate-based rule that counts by IP address.
- BB. Subscribe to AWS Shield Advanced, add the load balancer as a protected resource, and turn on automatic application layer DDoS mitigation for it.
- CC. Turn on Amazon GuardDuty and use an EventBridge rule to invoke a Lambda function that adds offending IP addresses as deny rules in the network ACL.
- DD. Have a Lambda function read the load balancer access logs every minute and add deny rules for offending IPs to the load balancer's security group.
Show the answer and explanation
Answer: A
- A. Right: Correct. AWS WAF inspects HTTP requests at the load balancer. The managed SQL database rule group blocks common SQL injection patterns, and a rate-based rule blocks any IP address that goes over a set number of requests in its evaluation window (5 minutes by default). Learn more: Rate-based rule statement (opens in a new tab)
- B. Wrong: Shield Advanced's automatic mitigation adds WAF rules that respond to request floods compared with a traffic baseline. It does not inspect requests for SQL injection, and it adds a monthly subscription cost. A WAF web ACL with a SQL injection rule group is still needed. Learn more: Automating application layer DDoS mitigation with Shield Advanced (opens in a new tab)
- C. Wrong: GuardDuty analyses CloudTrail, VPC flow logs and DNS logs, not the contents of HTTP requests, so it does not detect SQL injection. Network ACLs also hold a limited number of rules, and this is custom code to maintain. AWS WAF does both jobs as a managed service. Learn more: What is Amazon GuardDuty? (opens in a new tab)
- D. Wrong: Security groups only support allow rules, so there is no way to add a deny rule for an address. The approach is also custom code, and it cannot spot SQL injection without parsing every request. AWS WAF handles both needs at the load balancer. Learn more: Security group rules (opens in a new tab)
Explanation
AWS WAF protects Application Load Balancers, CloudFront and API Gateway at the HTTP layer. AWS Managed Rules include a SQL database rule group for injection attempts, and rate-based rules block a single IP address that sends too many requests in a 1, 2, 5 or 10 minute window. Shield Advanced targets DDoS floods, GuardDuty only detects, and security groups cannot deny.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.