A media streaming site on CloudFront and ALB suffers SQL injection probes, XSS in comments, and bot scraping of video metadata, must stay online during flash sales, and needs managed patching of attack signatures. Which network edge protection should the engineer implement to block OWASP Top 10 and bot threats?
Select an answer to reveal the explanation.
Short Explanation
You want a bouncer who recognizes troublemakers at the edge. Managed WAF rules block SQLi, XSS, and bad bots, while logging helps you tune protection without disrupting flash-sale traffic.
Full Explanation
Attaching AWS WAF to both CloudFront and the ALB with managed SQLi and XSS rules, Bot Control, and logging provides edge enforcement for global viewers and origin protection for dynamic paths. It blocks OWASP Top 10 payloads and metadata scraping, and meets the managed-patching requirement because AWS updates the rule logic; logs help you tune protection during flash sales. Using managed SQLi and XSS rules without bot detection leaves distributed video-metadata scraping insufficiently addressed: injection attempts may be blocked, but Bot Control’s behavioral and signature-based automation detection is absent. Shield Advanced with rate limiting can help preserve availability, but DDoS protection and throttling do not deeply inspect query strings, request bodies, or comments, so SQL injection and XSS can still reach the application. Custom SQLi, XSS, and bot rules maintained manually may initially provide coverage, but manual regex and rate-rule updates do not meet the managed-patching requirement and can become stale as bypass techniques change. Exam caveat: do not confuse staying online with staying secure; Shield, caching, and throttling address availability, while WAF inspects application content. Practical check: confirm WAF associations on both the distribution and ALB, pin managed rule versions, stream logs for count-versus-block tuning, and validate legitimate video URLs and comment inputs before enforcing block actions.