A company has an internal web-based application that employees use. The company hosts the application over a VPN in the company's on-premises…

The primary goal is to mitigate SQL injection, which is an application-layer (Layer 7) attack. The most suitable AWS service for this is AWS WAF.

1. First, an AWS WAF web access control list (web ACL) must be created with rules specifically designed to detect and block SQL injection attacks (A).

2. The current architecture uses a Network Load Balancer (NLB), which operates at the transport layer (Layer 4) and cannot inspect application traffic. Therefore, AWS WAF cannot be integrated with an NLB. The NLB must be replaced with an Application Load Balancer (ALB), which operates at the application layer (Layer 7) and supports WAF integration (C).

3. Finally, the created AWS WAF web ACL must be associated with the new ALB to filter incoming traffic and protect the EC2 instances (E).

B: Amazon CloudFront is a content delivery network designed for public-facing applications to reduce latency, which is unnecessary for an internal application accessed over a VPN.

D: AWS WAF cannot be associated with a Network Load Balancer. WAF requires a Layer 7 service like an ALB to inspect application content, whereas an NLB operates at Layer 4.

F: This option is incorrect because using CloudFront is not the appropriate architectural choice for this internal, VPN-based application scenario.

1. AWS WAF Developer Guide, "How AWS WAF works": This document states, "You can deploy AWS WAF on Amazon CloudFront, Application Load Balancer, Amazon API Gateway, and AWS AppSync." This confirms that an NLB is not a supported resource for WAF association.

2. AWS WAF Developer Guide, "AWS Managed Rules rule groups list": The "Core rule set (CRS) managed rule group" section lists rules such as SQLiBODY and SQLiQUERYARGUMENTS, which are specifically designed to protect against SQL injection attacks. This supports creating a WAF web ACL with these rules.

3. Elastic Load Balancing User Guide, "Product comparisons for Elastic Load Balancing": The feature comparison table clearly indicates that Application Load Balancers operate at the "Application (Layer 7)" while Network Load Balancers operate at the "Transport (Layer 4)". This distinction is critical for WAF integration.

4. AWS WAF Developer Guide, "Associating or disassociating a web ACL with an AWS resource": This page provides the definitive list of AWS resources that can be associated with a web ACL, which includes Application Load Balancer but not Network Load Balancer.