Your organization hosts an internet-facing application behind an Amazon CloudFront distribution. You want to mitigate common web exploits (for example, SQL injection and XSS) at the edge. Which action is the most appropriate way to do this using AWS services?

Add inbound rules to the security group so that only port 443 is open from the internet.

Security groups control network reachability (instance-level inbound/outbound), not application-layer payload inspection. Allowing port 443 does not prevent SQL injection or XSS because those attacks occur within the HTTP request content.

Enable AWS Shield Advanced to block SQL injection and XSS.

AWS Shield Advanced primarily provides protection against Distributed Denial of Service (DDoS) attacks. It is not designed for application exploit detection such as SQL injection/XSS, which is addressed by WAF.

Restrict IAM permissions for the application’s EC2 instances so that SQL injection payloads cannot be executed.

IAM permissions do not inspect or block malicious HTTP request payloads. SQL injection/XSS mitigation requires request filtering or input validation at the application or edge (for example, via AWS WAF).

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create an AWS WAF web ACL using managed rule sets and associate it with the CloudFront distribution. — Associate AWS WAF with your CloudFront distribution and use managed rule sets for common web exploit patterns. WAF evaluates HTTP/HTTPS requests at the edge and can block requests that match SQL injection/XSS signatures before they reach the origin. This directly targets exploit mitigation at the request-processing layer rather than only network access controls. Why others are wrong: Option B addresses only transport/network-level access, not application-layer exploit payloads. Option C focuses on DDoS protection rather than SQLi/XSS detection. Option D confuses authorization (IAM) with request filtering; IAM does not prevent execution of malicious content delivered over HTTP.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.