Protect Web App from SQL Injection and XSS with AWS WAF and Shield Advanced
A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)
Quick Answer
The answer is AWS WAF and AWS Shield Advanced used together. AWS WAF is a web application firewall that allows you to create custom rules to inspect HTTP(S) requests and block common exploits like SQL injection and cross-site scripting (XSS) at the application layer, and it integrates directly with an Application Load Balancer. AWS Shield Advanced complements this by providing enhanced, always-on detection and mitigation against large-scale DDoS attacks that could overwhelm the ALB or underlying EC2 instances. On the AWS Certified Security Specialty SCS-C02 exam, this pairing tests your understanding of layered defense: WAF handles application-layer threats (OWASP Top 10), while Shield Advanced handles volumetric network-layer attacks. A common trap is choosing CloudFront alone, which lacks built-in WAF rules without an attached web ACL, or NACLs, which operate at the subnet level and cannot inspect payload content. Memory tip: think "WAF for the words, Shield for the waves"—WAF filters malicious code in requests, Shield absorbs the flood of traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Shield Advanced
AWS WAF (Option D) can be associated with an ALB to filter web requests and protect against common exploits like SQL injection and cross-site scripting. AWS Shield Advanced (Option B) provides enhanced DDoS protection and integrates with WAF for additional layer 7 protections. Option A is wrong because GuardDuty is a threat detection service, not an inline web application firewall. Option C is wrong because Network ACLs operate at the subnet level and do not provide application-layer filtering. Option E is wrong because CloudFront is a CDN, and while it can be used with WAF, it alone does not provide WAF rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty is a threat detection service, not an inline prevention service.
- ✓
AWS Shield Advanced
Why this is correct
Shield Advanced provides advanced DDoS protection and integrates with WAF.
- ✗
Network ACLs
Why it's wrong here
NACLs operate at the subnet level and do not inspect application layer traffic.
- ✓
AWS WAF
Why this is correct
WAF can be attached to ALB to inspect and filter web requests.
- ✗
Amazon CloudFront
Why it's wrong here
CloudFront is a CDN; it can be used with WAF but not alone for filtering.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting. Which AWS service should they use?
medium- A.AWS Network Firewall
- ✓ B.AWS WAF
- C.AWS Firewall Manager
- D.AWS Shield Advanced
Why B: AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests and block malicious traffic based on customizable rules. This makes it the correct choice for the security team's requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.