A public permits website is seeing SQL injection style attempts in HTTP requests. Which AWS service is designed to filter those Layer 7 web exploits?
Select an answer to reveal the explanation.
Short Explanation
SQL injection rides in through web requests — WAF is the bouncer at the application door that checks those HTTP patterns and blocks the nasty ones. Think web exploit filter, not a disk encryption switch.
Full Explanation
AWS WAF (Web Application Firewall) is designed to filter Layer 7 web exploits such as SQL injection style attempts in HTTP requests against a public permits website. WAF is the bouncer at the application door that inspects HTTP patterns and blocks malicious requests. Amazon EBS volume encryption protects data at rest on disks; it is not a web exploit filter. AWS Snowcone is an edge/offline device, not an online request inspection layer for HTTP injections. Amazon Macie focuses on sensitive data discovery in data stores, not packet filtering on every subnet as a WAF substitute. Distractors fail by confusing encryption, offline devices, and data classification services with Layer 7 web filtering. Exam caveat: WAF complements Shield for DDoS and security groups for network ports; each operates at a different layer of the problem. Operational check: associate WAF with the ALB/CloudFront distribution fronting permits, enable managed rule groups for common exploits, tune false positives with the app team, log blocked requests, and review metrics after each public release. In practice, attach WAF to the permits CloudFront distribution or ALB, enable SQL injection managed rules, tune false positives with developers, and watch blocked-request metrics after releases.