DOP-C02 Security and Compliance Practice Question

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting attacks. Which AWS service should be integrated with the ALB?

⚠ Common exam trap

Watch out — candidates often confuse AWS WAF (Layer 7 application firewall) with AWS Network Firewall (Layer 3/4 stateful firewall) or AWS Shield (DDoS protection), not realizing that only WAF provides the specific rule sets needed for SQL injection and XSS mitigation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS WAF

AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS traffic. It uses managed rule groups to block common attack patterns like SQL injection (e.g., detecting malicious SQL keywords in query strings) and cross-site scripting (e.g., identifying script tags in user input). This makes it the correct choice for protecting web applications at Layer 7.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS Network Firewall
Why it's wrong here
AWS Network Firewall is a managed, stateful firewall that operates at the VPC boundary and filters traffic based on network attributes such as IP addresses, ports, protocols, and Suricata-compatible signature rules. While it can inspect and block certain malicious traffic, it is not a web application firewall and lacks the deep HTTP/HTTPS request parsing needed to distinguish legitimate application traffic from SQL injection or XSS payloads. It is better suited for network-layer segmentation and east-west traffic policing, not for per-request layer-7 filtering on an ALB.
✓
AWS WAF
Why this is correct
AWS WAF is the correct choice because it is a fully managed web application firewall that attaches directly to an Application Load Balancer to inspect each incoming HTTP/HTTPS request at the application layer. It can block, allow, or count requests matching conditions such as SQL injection signatures, XSS patterns, IP reputation lists, geo restrictions, and header or body size limits. AWS-managed rule groups, including the OWASP Top 10 rule sets, provide ready-made protection, and WAF integrates natively with ALB to stop malicious traffic before it reaches the EC2 instances.
✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced is a dedicated DDoS protection service that provides enhanced detection, always-on mitigations, and cost protection against volumetric and stateful DDoS attacks at the network and transport layers. It does not function as a rule-based web application firewall and cannot inspect individual request bodies, headers, or URI patterns to selectively block SQL injection or XSS attempts. Although Shield Advanced can be used alongside AWS WAF as part of a defense-in-depth strategy, it is not a substitute for WAF in this application-layer filtering scenario.
✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a continuous threat detection service that analyzes AWS CloudTrail management events, VPC Flow Logs, and DNS query logs to identify indicators of compromise such as brute-force attempts, cryptocurrency mining, or suspicious API call patterns. It operates asynchronously in the background and does not sit inline in the request path, so it cannot evaluate or filter live HTTP requests targeting the application. GuardDuty also lacks native rule sets for SQL injection and cross-site scripting, making it entirely unsuitable for the layer-7 filtering requirement described here.

Go deeper

DOP-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question