SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Shield Standard.

  Why it's wrong here

  AWS Shield Standard provides protection against Layer 3 and Layer 4 DDoS attacks. It does not provide Layer 7 protection against SQL injection or XSS. While useful, it is not the correct tool for addressing application-level web exploits, which require the deep packet inspection capabilities provided by AWS WAF.

• ✓

  AWS WAF.

  Why this is correct

  AWS WAF provides the ability to define rules that block specific application-layer exploits. By applying these rules to an ALB or CloudFront distribution, the organization can actively prevent SQL injection and XSS attacks, directly addressing the requirement to protect the application from these common web-based vulnerabilities.

• ✗

  Amazon GuardDuty.

  Why it's wrong here

  GuardDuty is a threat detection service that monitors logs for suspicious activity, such as malicious API calls or compromised instances. It does not actively block web exploits in real-time at the application layer. While it can detect an ongoing attack, it is not an inline firewall solution like WAF.

• ✗

  Network ACLs.

  Why it's wrong here

  Network ACLs operate at the network layer (Layer 3/4) by controlling traffic based on IP addresses and ports. They lack the intelligence to inspect the content of HTTP/HTTPS requests to identify SQLi or XSS patterns. Therefore, they are insufficient for protecting against application-layer exploits as requested in the scenario.