SAA-C03 Design Secure Architectures Practice Question
A company hosts a critical web application on Amazon EC2 instances in a VPC. The security team wants to protect the application from common web exploits like SQL injection and cross-site scripting. They also want to monitor and control access to the application at the HTTP/HTTPS level. Which AWS service should a solutions architect use to meet these requirements?
⚠ Common exam trap
Watch out — candidates often confuse network-level firewalls or DDoS protection with application-layer web exploit protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF integrated with an Application Load Balancer.
AWS WAF is specifically designed to protect web applications from application-layer attacks. When attached to an Application Load Balancer, it can inspect HTTP/HTTPS requests and apply rules to block SQL injection, XSS, and other exploits. It also provides logging and metrics for monitoring, satisfying the requirement to control access at the HTTP/HTTPS level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS WAF integrated with an Application Load Balancer.
Why this is correct
AWS WAF is a web application firewall that protects against common web exploits such as SQL injection and cross-site scripting. When integrated with an Application Load Balancer, it inspects incoming HTTP/HTTPS requests and applies rules to block malicious traffic. It also provides monitoring and logging of requests, meeting the security team's requirements.
- ✗
Amazon GuardDuty with VPC Flow Logs.
Why it's wrong here
GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not block web exploits in real time. VPC Flow Logs capture IP traffic metadata, not HTTP payloads. Together, they provide visibility but not prevention of SQL injection or XSS attacks.
- ✗
AWS Shield Advanced with an Elastic Load Balancer.
Why it's wrong here
AWS Shield Advanced provides protection against DDoS attacks, not application-layer exploits like SQL injection or XSS. While it is valuable for availability, it does not inspect HTTP/HTTPS payloads or provide web application firewall capabilities. Therefore, it does not meet the requirement to block common web exploits.
- ✗
AWS Network Firewall with a stateless rule group.
Why it's wrong here
AWS Network Firewall operates at the VPC level and can filter traffic based on IP, port, and protocol, but it does not inspect HTTP/HTTPS application-layer payloads for web exploits like SQL injection. It is not a web application firewall and cannot block XSS or SQLi based on request content.
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.