A company wants to inspect incoming HTTP requests to a public web application and block injection attempts using AWS-managed rule groups before the requests reach the application. Which service should they put in front of the app?
Show answer and explanation
Answer: B
WAF understands HTTP requests and evaluates them against rule groups, including AWS-managed groups for SQL injection, cross-site scripting and known bad inputs. Attaching a web ACL to the load balancer lets it block matching requests before they reach the application tier.
Network Firewall inspects packets and flows at the VPC edge, but the managed application-layer rule groups and request-level visibility come from WAF.
Why the other options are wrong
- A. Network Firewall provides stateful VPC inspection, including Suricata-style rules, but it is not the service that offers AWS-managed HTTP injection rule groups.
- C. Security groups decide whether a connection is allowed by address and port. They cannot read request bodies or detect injection payloads.
- D. NACLs filter packets by address, port and protocol. They have no visibility into HTTP content.