A public web application behind an ALB faces repeated SQL-injection attempts and L7 floods. Which AWS services address application-layer attacks? (Choose the best single answer.)
A.AWS Shield Standard alone
Shield Standard covers L3/L4 only, not application-layer payloads.
B.AWS WAF rules on the ALB (SQLi/XSS rate-limiting rules) — Shield Advanced optional for enhanced DDoS
Correct. WAF is the L7 filtering layer; Shield handles DDoS.
C.Security groups denying suspicious IPs
SGs can't filter by request content or dynamic rate limits.
D.Amazon Inspector agent on the instances
Inspector assesses vulnerabilities — it doesn't block attacks.
Why this answer
WAF inspects HTTP requests and blocks SQLi/XSS/rate abuse at the ALB/CloudFront layer. Shield Standard (free) covers L3/L4 floods automatically; Shield Advanced adds enhanced protection and response. Inspector finds host vulnerabilities — it doesn't filter web attacks.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Infrastructure Security practice session.
Practice Infrastructure Security