Courseiva
Infrastructure SecuritymediumMultiple ChoiceObjective-mapped

SCS-C02 Infrastructure Security Practice Question

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

AWS WAF

AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering. AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • AWS WAF

    Why this is correct

    AWS WAF filters and monitors HTTP requests to protect against web exploits.

  • Network ACLs

    Why it's wrong here

    Network ACLs operate at the subnet level as a stateless packet filter, inspecting only IP addresses, ports, and protocols; they lack the application-layer inspection required to detect and block SQL injection or cross-site scripting payloads embedded in HTTP requests. This option is tempting because network ACLs are a standard perimeter defence for controlling traffic to subnets, and they would be the correct choice if the requirement were to restrict inbound IP ranges or block specific ports at the network boundary rather than to filter application-layer attacks.

  • Security Groups

    Why it's wrong here

    Security Groups are stateful firewalls for instances, not application-layer inspection.

  • AWS Shield Advanced

    Why it's wrong here

    Shield Advanced protects against DDoS attacks, not application-layer exploits.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.