A customer-facing web application in a public cloud is being probed with SQL injection and cross-site scripting payloads inside otherwise normal HTTPS requests to port 443. The security group must keep allowing TCP 443 from anywhere. Which control addresses these attacks?
Select an answer to reveal the explanation.
Short Explanation
A bouncer who only checks that guests came through the front door won't notice the one carrying a crowbar. Security groups and ACLs check addresses and ports; a WAF opens the request and looks at what's inside it. Since the attack rides on port 443 traffic you must allow, only a Layer 7 control can see it.
Full Explanation
SQL injection and cross-site scripting are application-layer attacks carried inside legitimate-looking HTTP requests, so they cannot be distinguished from normal traffic by address or port. A web application firewall terminates or otherwise decrypts the HTTPS session, parses the HTTP request, and applies rules and signatures that recognize injection strings, script payloads and protocol abuse, blocking or sanitizing the malicious requests while letting normal traffic through. That Layer 7 visibility is what the scenario requires, because TCP 443 must stay open to everyone. Restricting the security group to known customer ranges is impractical for a public application, contradicts the stated requirement, and still would not inspect payloads from allowed sources. A subnet network ACL is stateless packet filtering on addresses, ports and protocol; it does not reassemble HTTP requests or examine their content. A site-to-site IPsec tunnel encrypts traffic between two networks, which protects confidentiality in transit but neither applies to public customers nor inspects application payloads. Exam caveat: a WAF reduces risk but does not replace secure coding; parameterized queries and output encoding remain the root fixes. Operational check: run the WAF in detection mode, confirm the probing requests match injection and XSS rules without blocking legitimate traffic, then switch the relevant rules to blocking.