ANS-C01 Network Security, Compliance and Governance Practice Question

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests that contain SQL injection attacks. Which WAF rule type should they use?

⚠ Common exam trap

It's easy for candidates to confuse a rate-based rule (which controls request frequency) with a content-inspection rule, or assume that an IP set rule can block attacks based on source reputation, when in fact only managed rule groups or custom rules with SQL injection match conditions can inspect request content for injection patterns.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Managed rule group for SQL injection

AWS WAF provides managed rule groups specifically designed to detect common web threats, including SQL injection attacks. The 'Managed rule group for SQL injection' contains pre-configured rules that inspect request components (such as query strings, URI, and body) for SQL injection patterns, making it the correct choice for blocking such attacks without requiring custom rule authoring.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
IP set rule
Why it's wrong here
IP set rules block or allow IP addresses.
✓
Managed rule group for SQL injection
Why this is correct
AWS WAF managed rules include SQL injection detection.
✗
Rate-based rule
Why it's wrong here
Rate-based rules limit request rate, not specific attack patterns.
✗
Geographic match rule
Why it's wrong here
Geographic rules filter by country.

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question