SOA-C02 · Question #47
A SysOps Administrator is deploying a legacy web application on AWS. The application has four Amazon EC2 instances behind Classic Load Balancer and stores data in an Amazon RDS instance. The legacy…
The correct answer is B. Configure AWS WAF with a Classic Load Balancer for protection against SQL injection attacks. Option B is correct because AWS WAF (Web Application Firewall) can be attached directly to a Classic Load Balancer and includes managed rule groups specifically designed to detect and block SQL injection patterns - protecting the application at the network edge without touching…
Question
A SysOps Administrator is deploying a legacy web application on AWS. The application has four Amazon EC2 instances behind Classic Load Balancer and stores data in an Amazon RDS instance. The legacy application has known vulnerabilities to SQL injection attacks, but the application code is no longer available to update. What cost-effective configuration change should the Administrator make to migrate the risk of SQL injection attacks?
Options
- AConfigure Amazon GuardDuty to monitor the application for SQL injection threats.
- BConfigure AWS WAF with a Classic Load Balancer for protection against SQL injection attacks.
- CReplace the Classic Load Balancer with an Application Load Balancer and configure AWS WAF
- DConfigure an Amazon CloudFront distribution with the Classic Load Balancer as the origin and
How the community answered
(43 responses)- A9% (4)
- B63% (27)
- C5% (2)
- D23% (10)
Explanation
Option B is correct because AWS WAF (Web Application Firewall) can be attached directly to a Classic Load Balancer and includes managed rule groups specifically designed to detect and block SQL injection patterns - protecting the application at the network edge without touching the unavailable source code, making it the most cost-effective solution.
Why the distractors are wrong:
- A (GuardDuty): GuardDuty is a threat detection service - it alerts you to suspicious activity but does not actively block SQL injection requests. Detection alone doesn't mitigate the risk.
- C (Replace CLB with ALB + WAF): WAF works with Classic Load Balancer directly, so replacing the CLB with an ALB is unnecessary infrastructure cost. The question asks for cost-effective - don't pay to replace what already works.
- D (CloudFront + CLB origin): Adding CloudFront introduces additional cost and architectural complexity solely to gain WAF integration, when WAF can be attached to the existing CLB without a CDN layer.
Memory tip: When you see "legacy app, can't change code, SQL injection" - think WAF is your patch. It intercepts malicious requests before they ever reach your application, acting like a security guard at the door. Also remember: WAF attaches to CLB, ALB, CloudFront, and API Gateway - you don't need to upgrade your load balancer to use it.
Topics
Community Discussion
No community discussion yet for this question.