AWS Certified Data Engineer Associate · Free Practice Question Medium
Question 36
A global media company uses a fleet of Amazon EC2 instances (behind an Application Load Balancer) to power its video streaming application. To improve the performance of the application, the data engineering team has also created an Amazon CloudFront distribution with the Application Load Balancer as the custom origin. The security team at the company has noticed a spike in the number and types of SQL injection and cross-site scripting attack vectors on the application.
Which of the following solutions would you recommend as the MOST effective in countering these malicious attacks?
-
A
Use Amazon Route 53 with Amazon CloudFront distribution
-
B
Use AWS Web Application Firewall (AWS WAF) with Amazon CloudFront distribution
-
C
Use security groups with Amazon CloudFront distribution
-
D
Use AWS Config with CloudFront distribution
Reveal correct answer
Correct answer: B
Explanation
Correct option:
Use AWS Web Application Firewall (AWS WAF) with Amazon CloudFront distribution
AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define.
How AWS WAF Works:
A web access control list (web ACL) gives you fine-grained control over the web requests that your Amazon CloudFront distribution, Amazon API Gateway API, or Application Load Balancer responds to.
When you create a web ACL, you can specify one or more Amazon CloudFront distributions that you want AWS WAF to inspect. AWS WAF starts to allow, block, or count web requests for those distributions based on the conditions that you identify in the web ACL. Therefore, combining AWS WAF with Amazon CloudFront can prevent SQL injection and cross-site scripting attacks. So this is the correct option.
Incorrect options:
Use Amazon Route 53 with Amazon CloudFront distribution - Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. You cannot use Route 53 to prevent SQL injection and cross-site scripting attacks. So this option is incorrect.
Use security groups with Amazon CloudFront distribution - A security group controls the traffic that is allowed to reach and leave the resources that it is associated with. For example, after you associate a security group with an EC2 instance, it controls the inbound and outbound traffic for the instance.
When you create a VPC, it comes with a default security group. You can create additional security groups for a VPC, each with its own inbound and outbound rules. You can specify the source, port range, and protocol for each inbound rule. You can specify the destination, port range, and protocol for each outbound rule. You cannot use security groups to prevent SQL injection and cross-site scripting attacks. So this option is incorrect.
Use AWS Config with CloudFront distribution - AWS Config helps with auditing and recording compliance of your AWS resources. You cannot use AWS Config to prevent SQL injection and cross-site scripting attacks. So this option is incorrect.
References:
https://aws.amazon.com/waf/features/
https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html
https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
