SCS-C02 Infrastructure Security Practice Question
A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF
AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering. AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS WAF
Why this is correct
AWS WAF filters and monitors HTTP requests to protect against web exploits.
- ✗
Network ACLs
Why it's wrong here
Network ACLs operate at the subnet level as a stateless packet filter, inspecting only IP addresses, ports, and protocols; they lack the application-layer inspection required to detect and block SQL injection or cross-site scripting payloads embedded in HTTP requests. This option is tempting because network ACLs are a standard perimeter defence for controlling traffic to subnets, and they would be the correct choice if the requirement were to restrict inbound IP ranges or block specific ports at the network boundary rather than to filter application-layer attacks.
- ✗
Security Groups
Why it's wrong here
Security Groups are stateful firewalls for instances, not application-layer inspection.
- ✗
AWS Shield Advanced
Why it's wrong here
Shield Advanced protects against DDoS attacks, not application-layer exploits.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.