ANS-C01 practice question 33 of 35

A company has an internal web-based application that employees use. The company hosts the application over a VPN in the company's on-premises…

A company has an internal web-based application that employees use. The company hosts the application over a VPN in the company's on-premises network. The application runs on a fleet of Amazon EC2 instances in a private subnet behind a Network Load Balancer (NLB) in the same subnet. The instances are in an Amazon EC2 Auto Scaling group. During a recent security incident, SQL injection occurred on the application. A network engineer must implement a solution to prevent SQL injection attacks in the future. Which combination of steps will meet these requirements? (Select THREE.)

Answer options

A: Create an AWS WAF web ACL that includes rules to block SQL injection attacks Correct answer

B: Create an Amazon CloudFront distribution. Specify the EC2 instances as the origin.

C: Replace the NLB with an Application Load Balancer Correct answer

D: Associate the AWS WAF web ACL with the NLB.

E: Associate the AWS WAF web ACL with the Application Load Balancer. Correct answer

F: Associate the AWS WAF web ACL with the Amazon CloudFront distribution.

Correct Answer:

A. Create an AWS WAF web ACL that includes rules to block SQL injection attacks; C. Replace the NLB with an Application Load Balancer; E. Associate the AWS WAF web ACL with the Application Load Balancer.

Explanation

AWS WAF is a web application firewall that protects web applications from common exploits like SQL injection. However, WAF cannot be directly associated with a Network Load Balancer (NLB) because NLBs operate at the transport layer (Layer 4) and do not inspect application-layer traffic. To use WAF, the NLB must be replaced with an Application Load Balancer (ALB), which operates at the application layer (Layer 7). The solution requires creating a WAF web ACL with rules to block SQL injection attacks and then associating this web ACL with the newly created ALB.

Why Incorrect

B. Creating a CloudFront distribution is unnecessary for an internal application accessed over a VPN and adds complexity.
D. AWS WAF cannot be associated with a Network Load Balancer, as NLBs operate at Layer 4.
F. While WAF can be associated with CloudFront, using an ALB is a more direct and appropriate solution for this internal architecture.

References

1. AWS WAF Developer Guide. (2023). Associating a web ACL with an AWS resource. Amazon Web Services. Retrieved from https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating.html (This page lists supported resources: Application Load Balancer, Amazon CloudFront, Amazon API Gateway, AWS AppSync, and Amazon Cognito user pool. NLB is not listed).

2. AWS WAF Developer Guide. (2023). Rule statements - SQL injection attack rule statement. Amazon Web Services. Retrieved from https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case-sql-injection.html (This section describes the managed rule group for SQL injection).

3. Elastic Load Balancing User Guide. (2023). What is an Application Load Balancer?. Amazon Web Services. Retrieved from https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html (States that ALBs operate at the application layer, Layer 7).

4. Elastic Load Balancing User Guide. (2023). What is a Network Load Balancer?. Amazon Web Services. Retrieved from https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html (States that NLBs operate at the transport layer, Layer 4).

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test