Question 1,106 of 1,621
AWS WAF for ALB — Protecting Against Web Exploits
A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and receives traffic from clients. The company wants to improve security by adding an additional layer of protection against common web exploits like SQL injection and cross-site scripting. Which AWS service should they use?
Quick Answer
The answer is AWS WAF. This is the correct choice because AWS WAF is a web application firewall specifically designed to inspect HTTP and HTTPS requests at the application layer, allowing it to block common web exploits like SQL injection and cross-site scripting (XSS) before they reach your Application Load Balancer. It integrates directly with an ALB, enabling you to define customizable rules that filter malicious traffic based on request patterns, IP addresses, or URI strings. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this question tests your understanding of how to layer security at the network edge—a common scenario where candidates might mistakenly choose AWS Shield (which protects against DDoS, not application-layer exploits) or a Network ACL (which operates at the transport layer). A helpful memory tip: think of WAF as the “web-aware” filter that reads the content of requests, while Shield is the “shield” against volumetric attacks.
⚠ Common exam trap
Many exam-takers confuse AWS WAF with AWS Shield Advanced, mistakenly thinking Shield Advanced covers application-layer exploits, when in fact Shield Advanced focuses on volumetric DDoS protection and WAF handles Layer 7 threats like SQL injection and XSS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF
AWS WAF (Web Application Firewall) is the correct service because it is specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and apply customizable rules to block malicious traffic before it reaches the EC2 instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Firewall Manager
Why it's wrong here
Central management of firewall rules.
- ✓
AWS WAF
Why this is correct
Web application firewall that filters SQL injection and XSS.
- ✗
AWS Shield Advanced
Why it's wrong here
DDoS protection service.
- ✗
Network ACLs
Why it's wrong here
Stateless packet filtering at subnet level.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An e-commerce company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. During a flash sale, the application experiences high latency. The network team notices that the ALB is receiving more traffic than expected. What is the most likely cause?
medium- A.The ALB is configured to terminate HTTPS, which increases CPU load on the ALB.
- B.The Auto Scaling group's scaling policies are too aggressive, causing frequent instance launches.
- C.The ALB health checks are too frequent, consuming resources.
- ✓ D.The ALB is not protected by AWS WAF, allowing a DDoS attack or excessive traffic to reach the backend.
Why D: The sudden spike in traffic reaching the ALB beyond expected levels, combined with high latency, strongly indicates that the ALB is being overwhelmed by malicious or excessive traffic. Without AWS WAF protection, the ALB cannot filter out DDoS attacks or unwanted requests at Layer 7, so all traffic passes through to the backend instances, causing resource exhaustion and latency. AWS WAF integrates directly with ALBs to inspect and block malicious traffic before it reaches the application.
Last reviewed: Jun 24, 2026
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.