A public web app on CloudFront with an ALB origin faces SQL injection, XSS, and bot scraping that bypassed basic filters. The team needs managed OWASP coverage, bot mitigation, and hardened browser headers. Which edge protection implementation best addresses these threats?
Select an answer to reveal the explanation.
Short Explanation
You stop web attacks where they land. WAF inspects requests while hardened headers limit browser abuse. It's sunscreen plus bouncer at the club entrance.
Full Explanation
The correct implementation is right because it inspects at the CloudFront edge for global scale, uses AWS Managed Rules for OWASP Top 10 to block SQL injection and XSS patterns that bypassed basic filters, adds the Bot Control managed group to detect scraping with behavioral and challenge logic, and applies response headers policies to harden browsers with HSTS, content-type protections, and framing controls. The alternative combining OWASP rules with Security Headers but omitting Bot Control fails on automated threat mitigation, leaving scraping unchecked despite fixing injection and header hardening. The alternative combining OWASP and Bot Control with default caching fails on browser hardening, improving performance while blocking attacks and bots but leaving clickjacking and protocol-downgrade risks from missing headers. The alternative combining Bot Control and rate-based rules with Security Headers fails on signature-based OWASP coverage, limiting volumetric abuse but missing curated SQLi and XSS pattern detection. Exam caveat: associate WAF scope carefully since CloudFront uses global scope while ALB uses regional scope, and Shield Advanced addresses DDoS resilience rather than scraping or injection. Practical check: verify in WAF sampled requests that OWASP and Bot Control rules trigger blocks, confirm security headers appear in browser dev tools, and monitor bot metrics for reduced scraping without blocking legitimate crawlers.