DOP-C02 Security and Compliance Practice Question
A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer (ALB). The application uses an RDS MySQL database. The security team performed a penetration test and discovered that the application is vulnerable to SQL injection. The development team has deployed a WAF web ACL to the ALB that includes rules to block SQL injection attacks. However, after the deployment, the application started returning 403 errors for legitimate requests, and the security team needs to investigate. The team also wants to ensure that only approved AWS services can access the RDS database. The current security groups are configured with a rule that allows inbound traffic from the ALB security group to the RDS database on port 3306. Which combination of actions should the security team take to resolve the issue and improve the security posture?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Switch the WAF web ACL to count mode while tuning the rules, and implement an IAM policy to restrict database access to specific AWS services using the aws:SourceArn condition key.
The correct answer. Switching the WAF web ACL to count mode allows the security team to monitor requests that would be blocked without actually blocking them, enabling them to fine-tune the rules to eliminate false positives while still protecting against SQL injection. Additionally, implementing an IAM policy with the aws:SourceArn condition key can restrict database access to only approved AWS services, such as Lambda functions or specific EC2 instances, enhancing the security posture beyond just network-level controls. Option A is incorrect because disabling WAF rules would leave the application vulnerable, and network ACLs are stateless and not sufficient for fine-grained access control. Option B is incorrect because relying solely on security groups with VPC CIDR allows broad access and does not address the false positive issue. Option C is incorrect because adding a second ALB is unnecessary and does not solve the false positive problem, and using count mode alone without IAM policy does not address database access restrictions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the WAF rules that are causing false positives and add network ACLs to block all traffic to the database except from the ALB.
Why it's wrong here
Disabling the existing WAF rules outright instead of moving them to count mode throws away all web request inspection and reopens the door to SQL injection, whereas count mode is designed to let you evaluate and tune rules without dropping legitimate traffic. Network ACLs are stateless and evaluated on a per-subnet basis; they can only filter on IP/port/protocol, so they cannot restrict database access to a specific IAM role, service, or SourceArn and are far coarser-grained than the identity-based policy the correct solution uses.
- ✗
Remove the WAF web ACL and rely on security group ingress rules that allow all traffic from the VPC CIDR to the database.
Why it's wrong here
Discarding the WAF web ACL entirely eliminates application-layer filtering and leaves the ECS Fargate application exposed to SQL injection and other OWASP-style threats that security groups cannot detect, because security groups operate at the network and transport layers only. Further, allowing all traffic from the entire VPC CIDR to the database means any workload or compromised instance with VPC access can reach the database, violating least privilege and providing none of the identity-based authorization that aws:SourceArn can enforce.
- ✗
Switch the WAF web ACL to count mode and add a second ALB in front of the database to filter traffic.
Why it's wrong here
Inserting an ALB between ECS and a database is architecturally nonsensical because ALB is an HTTP/HTTPS load balancer, while database connections use native protocols like MySQL/PostgreSQL and are not HTTP-based; moreover, count mode only logs or samples requests without blocking, so it does not deliver the required security control. Simply switching to count mode still leaves the false positives unaddressed and adds an unnecessary network hop, and neither measure enforces an IAM-level authorization that limits database access to approved services.
- ✓
Switch the WAF web ACL to count mode while tuning the rules, and implement an IAM policy to restrict database access to specific AWS services using the aws:SourceArn condition key.
Why this is correct
Switching to count mode allows monitoring and tuning of WAF rules to eliminate false positives while still detecting SQL injection. Implementing an IAM policy with the aws:SourceArn condition key restricts database access to only approved AWS services, enhancing security beyond network controls.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.