ANS-C01 Network Implementation Practice Question

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

⚠ Common exam trap

Many exam-takers confuse security groups (layer 4 filtering) with web application firewalls (layer 7 inspection), leading them to incorrectly select the security group option, even though security groups cannot inspect application-layer payloads like SQL injection strings.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Application Load Balancer.

AWS WAF is a web application firewall that protects web resources from common exploits like SQL injection. It integrates directly with Application Load Balancers (ALBs) by allowing you to associate a web ACL with the ALB, which inspects HTTP/HTTPS traffic before it reaches the backend EC2 instances. This is the only supported integration point among the options for protecting application-layer traffic in this architecture.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The Application Load Balancer.
Why this is correct
The Application Load Balancer. [CORRECT]
✗
Amazon Route 53 hosted zone.
Why it's wrong here
Amazon Route 53 hosted zone. [wrong]
✗
The security group of the EC2 instances.
Why it's wrong here
The security group of the EC2 instances. [wrong]
✗
The VPC internet gateway.
Why it's wrong here
The VPC internet gateway. [wrong]

Visual reference

Go deeper

ANS-C01 Network Implementation Practice Question

Why each option matters

Option-by-option breakdown

Related to this question