These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-031
You want to block requests that attempt SQL injection or cross-site scripting against a web application running behind an Application Load Balancer, before they reach the application. Which configuration is the most appropriate for keeping up with known attack patterns without maintaining your own rules?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: B. Associate an AWS WAF web ACL with the ALB and apply AWS Managed Rules (Core rule set / SQL database)
Explanation
SQL injection and XSS cannot be identified without inspecting the contents of the HTTP request (layer 7). If you associate an AWS WAF web ACL with the ALB and apply managed rule groups that AWS continuously updates, you can block known attack patterns without maintaining signatures yourself.
Per-choice explanations
A. Add an inbound rule to the subnet network ACL that denies requests containing attack strings
Incorrect. A network ACL is a stateless filter that evaluates IP addresses, protocols, and ports at the subnet boundary, and it cannot see the contents of an HTTP request.
B. Associate an AWS WAF web ACL with the ALB and apply AWS Managed Rules (Core rule set / SQL database)
Correct. Associating a web ACL with the ALB and applying AWS Managed Rule groups blocks layer 7 attack patterns before they reach the application.
C. Keep adding inbound rules to the ALB security group that deny the source IP addresses of attackers
Incorrect. A security group only looks at layer 3/4 information such as source IP and port, so it cannot evaluate attack strings in the request body. Security groups also have no deny rules at all; they consist only of allow rules.
D. Subscribe to AWS Shield Advanced and block requests that contain attacks with its DDoS mitigation features
Incorrect. AWS Shield is intended to mitigate DDoS attacks centered on layers 3/4, and it does not perform payload inspection such as SQL injection or XSS. An AWS Shield Advanced subscription includes AWS WAF usage fees, but it is the WAF rules that actually inspect and block requests.
Practical Use
AWS WAF is a web application firewall that inspects HTTP / HTTPS requests at layer 7. Rules are grouped into a unit called a web ACL, which you associate with a CloudFront distribution, an Application Load Balancer, API Gateway, AppSync, a Cognito user pool, and so on. Rule types include source IP sets, rate-based rules (blocking based on the number of requests within a time window), string and regex matches, and managed rule groups provided by AWS or by Marketplace vendors. Because AWS continuously updates its managed rule groups, you no longer need to maintain signatures yourself. In terms of design, the first consideration is where you associate the web ACL, because that determines where attacks are stopped. If you associate it with CloudFront, attacks are dropped at edge locations, whereas associating it with an ALB means requests are evaluated only after they reach the Region. Also, when you apply managed rules in production, switching straight to the Block action can drop legitimate requests, so the standard approach is to run them in Count mode for a while first, check for false positives using CloudWatch metrics and sampled requests, and only then switch to Block. WAF pricing consists of a monthly charge per web ACL and per rule, plus a usage-based charge for the number of requests. On SAA-C03, terms such as "SQL injection," "cross-site scripting," "OWASP Top 10," and "a flood of requests from specific IP addresses" point to AWS WAF as the correct answer. Distractors include security groups (layer 3/4, no deny rules), network ACLs (stateless IP / port filters), and AWS Shield (DDoS mitigation). The division of roles between Shield and WAF, and the decision of whether to attach WAF to CloudFront or to an ALB, are also commonly asked.