A media company serves a global news portal via CloudFront to an ALB origin, facing SQL injection, XSS, and credential-stuffing bursts that bypass security groups. It needs OWASP Top 10 filtering, bot throttling, and hardened response headers. Which edge protection configuration blocks these application threats?
Select an answer to reveal the explanation.
Short Explanation
You're pushing defense right to the edge where attacks arrive. Layered WAF rules plus hardened headers filter bad payloads before they touch your origin.
Full Explanation
AWS WAF associated at CloudFront and ALB inspects Layer 7 requests with AWS Managed Rules for SQL injection, cross-site scripting, and known bad inputs plus rate-based rules for credential stuffing and bot bursts, while CloudFront response headers policies add hardening such as HSTS, frame options, and content-type protections that mitigate OWASP Top 10 risks at the edge with low latency. Security groups and NACLs fail by concept because network-layer filters evaluate IPs and ports and cannot parse SQL or script payloads nor apply request-rate logic per HTTP attribute. Route 53 failover and certificates fail by concept because availability routing and TLS encryption provide resilience and confidentiality but no inspection or blocking of malicious application content. Inspector and signed URLs fail by concept because vulnerability scanning and content access control do not provide inline request filtering or throttling of active exploits. For the exam remember WAF sits on CloudFront, ALB, and API Gateway with managed groups plus rate limiting, and in practice verify rule order, logging to S3, and header policy attachment.