ANS-C01 Network Security, Compliance and Governance Practice Question
A company is deploying a web application in a VPC and wants to protect it from common web exploits like cross-site scripting (XSS). Which AWS service should be used to filter and monitor HTTP requests?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF
AWS WAF, is the correct choice because it is a web application firewall specifically designed to filter and monitor HTTP/HTTPS requests to protect against common web exploits like cross-site scripting (XSS), SQL injection, and other OWASP Top 10 threats. Option A is incorrect because Security Groups act as a virtual firewall at the instance level, controlling inbound and outbound traffic based on IP addresses and ports, not at the application layer. Option B is incorrect because Network ACLs are stateless subnet-level firewalls that also operate at the network layer, not the application layer. Option D is incorrect because AWS Shield Advanced provides DDoS protection, not web application filtering or monitoring of HTTP requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Group
Why it's wrong here
Security groups are stateful firewalls but do not inspect HTTP payloads.
- ✗
Network ACL
Why it's wrong here
Network ACLs operate at the network layer and cannot inspect application-layer traffic.
- ✓
AWS WAF
Why this is correct
AWS WAF provides rules to filter HTTP requests and block attacks like XSS.
- ✗
AWS Shield Advanced
Why it's wrong here
Shield Advanced protects against DDoS attacks, not application-layer exploits.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.