SCS-C03 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable the AWS Managed Rules SQL database rule set and immediately set the action to Block.

  Why it's wrong here

  Immediately setting the rule to Block is risky because legitimate traffic containing technical strings might match the SQLi patterns, leading to false positives. Without a testing phase, the application's availability for valid users could be compromised by over-eager security constraints that do not account for specific business use cases.

• ✗

  Create a custom WAF rule with a regex pattern for SQL keywords and apply it to the ALB.

  Why it's wrong here

  Creating custom regex patterns for SQL injection is complex and difficult to maintain. It is easy to miss sophisticated obfuscation techniques used by attackers. Managed rules are updated by AWS experts to handle evolving threats, making them a much more reliable and scalable choice for standard attack vectors.

• ✓

  Deploy the SQLi managed rule in Count mode, analyze the logs, and then apply a scope-down statement to exclude specific documentation paths.

  Why this is correct

  Using Count mode allows the team to monitor which requests would have been blocked without impacting users. By analyzing WAF logs, they can identify legitimate documentation paths that trigger the rule and use scope-down statements to exempt those specific paths, ensuring high security with minimal false positives.

• ✗

  Use a Network ACL to block the source IP addresses of the attackers identified in the ALB access logs.

  Why it's wrong here

  Blocking IPs at the NACL level is ineffective against distributed attacks and doesn't address the root cause of the SQL injection attempt. Attackers can easily rotate IPs, and NACLs are stateless and limited in the number of rules they can support, making them unsuitable for dynamic application-layer protection.