Protect EC2 and RDS from SQL Injection with Least Overhead

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Use AWS WAF to protect the application from SQL injection and other web-based attacks with the least operational overhead.

Question

A company has deployed its application on Amazon EC2 instances with an Amazon RDS database. The company used the principle of least privilege to configure the database access credentials. The company's security team wants to protect the application and the database from SQL injection and other web-based attacks. Which solution will meet these requirements with the LEAST operational overhead?
  1. Use security groups and network ACLs to secure the database and application servers.
  2. Use AWS WAF to protect the application. Use RDS parameter groups to configure the security settings. Correct Answer
  3. Use AWS Network Firewall to protect the application and the database.
  4. Use different database accounts in the application code for different functions. Avoid granting excessive privileges to the database users.

Key Takeaways

The question tests the ability to identify the specific AWS service designed for web application firewalls (WAF) versus network security controls.

AWS WAF is the correct solution to protect web applications against SQL injection and other web-based attacks with minimal operational overhead.

Common mistake: Candidates often select security groups or NACLs, confusing network-layer filtering with the application-layer protection required for SQL injection prevention.

Expert Analysis

Why the Answer Is Correct

Option B is the correct choice because AWS Web Application Firewall (WAF) operates at Layer 7 (Application Layer), which is where SQL injection attacks occur. By deploying WAF in front of the application (typically via an ALB or CloudFront), it inspects HTTP/HTTPS requests and filters out malicious patterns like SQL queries before they reach the EC2 instances. This provides the necessary protection with significantly less operational overhead than managing host-based rules or custom code.

Why the Other Options Are Wrong

Options A (Security Groups/NACLs) only provide network-layer (Layer 3/4) filtering based on IP and port; they cannot inspect packet payload content for SQL syntax. Option C (Network Firewall) is a stateful, cloud-native firewall for network traffic but lacks the specialized rule sets for complex web threats like SQL injection compared to WAF. Option D suggests manual credential management, which increases operational overhead and does not actively block incoming attack traffic.

Community Comment Notes

The community consensus strongly supports Option B. Users noted that 'SQL injection -> WAF' is a direct association tested in the exam. One user pointed out a technical nuance that WAF cannot be attached directly to EC2, implying it must be placed behind a load balancer or CDN, but this does not invalidate WAF as the correct service choice for protection.

Official Reference

https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-managing-rules.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between network-level security (Security Groups, NACLs) and application-level security (WAF). If the threat involves HTTP payloads, SQL injection, or cross-site scripting, WAF is almost always the answer.

Frequently Asked Questions

Can AWS WAF be attached directly to an EC2 instance?

No, WAF must be associated with an Application Load Balancer (ALB), CloudFront distribution, or API Gateway, not directly with EC2.

Why isn't Security Groups enough for SQL injection?

Security Groups filter traffic by IP and port (Layer 3/4), whereas SQL injection occurs within the HTTP request payload (Layer 7).

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. BillaRanga 👍 5 Answered B
    protect the application and the database from SQL injection and other web-based attacks. -> WAF
  2. 03beafc 👍 2
    It's probably still B, but waf can't be attached directly to ec2's
  3. Andy_09 👍 8
    Option B
  4. Typewriter101 👍 3 Answered B
    SQL injection -> WAF

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide