A public-facing web application behind an Application Load Balancer is being probed with SQL injection attempts inside request bodies. The team wants to inspect and block malicious requests based on their HTTP content before they reach the application, without changing application code. Which service should they attach to the load balancer?
- Amazon GuardDuty, attached directly to the ALB to inspect request payloads
- AWS Shield Advanced, configured with a custom Layer 7 payload-inspection rule
- AWS WAF, associated with the ALB through a web ACL containing a rule that matches SQL injection patterns
- Security groups on the ALB, adding an inbound rule that denies traffic containing SQL keywords
Why C? And why not the others?
Correct answer: C. AWS WAF, associated with the ALB through a web ACL containing a rule that matches SQL injection patterns
AWS WAF operates at the application layer and inspects the actual content of HTTP requests, including headers, URI, and body, and it is associated with an Application Load Balancer through a web ACL that can include managed or custom rules matching patterns such as SQL injection, letting it block malicious requests before they reach the application with no code changes. The option describing GuardDuty is wrong because GuardDuty is a threat-detection service that analyzes sources like VPC Flow Logs, DNS query logs, and CloudTrail events for suspicious activity; it does not attach to a load balancer or inspect individual HTTP request payloads. The option describing Shield Advanced is wrong because Shield protects against network and transport layer (layer 3/4) DDoS attacks and provides cost protection and expert support during large attacks, but it does not offer custom content-matching rules for inspecting request bodies for patterns like SQL injection. The option describing security groups is wrong because security groups filter traffic only by IP address, port, and protocol at the network layer; they cannot parse or match against the contents of an HTTP request body.
Source: AWS WAF documentation: How AWS WAF works with web ACLs and managed rule groups