ANS-C01 Network Security, Compliance and Governance Practice Question
A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team needs to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF
AWS WAF (Option B) is the correct service because it integrates with Application Load Balancers to filter HTTP/HTTPS requests and can block common web exploits such as SQL injection and cross-site scripting. AWS Shield Advanced (Option A) provides enhanced DDoS protection, which does not mitigate web application layer attacks like SQL injection or XSS. AWS Network Firewall (Option C) operates at the network layer and is not designed for application-layer threats. Amazon GuardDuty (Option D) is a threat detection service, not a prevention tool. AWS Firewall Manager (Option E) centralizes firewall rule management but does not directly protect against web exploits. Therefore, only Option B is correct for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced provides DDoS protection at the network/transport layer, but it does not protect against application-layer web exploits like SQL injection or cross-site scripting.
- ✓
AWS WAF
Why this is correct
AWS WAF integrates with Application Load Balancers to filter HTTP/HTTPS requests and can block common web exploits such as SQL injection and cross-site scripting. This directly addresses the security team's requirement.
- ✗
AWS Network Firewall
Why it's wrong here
AWS Network Firewall is a managed firewall for network and transport layer filtering, not suitable for application-layer web attacks.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that identifies malicious activity but does not actively prevent web exploits.
- ✗
AWS Firewall Manager
Why it's wrong here
AWS Firewall Manager helps centrally manage firewall rules across accounts but does not directly protect against web application attacks.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests that contain SQL injection attacks. Which WAF rule type should they use?
medium- A.IP set rule
- ✓ B.Managed rule group for SQL injection
- C.Rate-based rule
- D.Geographic match rule
Why B: AWS WAF provides managed rule groups specifically designed to detect common web threats, including SQL injection attacks. The 'Managed rule group for SQL injection' contains pre-configured rules that inspect request components (such as query strings, URI, and body) for SQL injection patterns, making it the correct choice for blocking such attacks without requiring custom rule authoring.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.