A city public-works portal is hit with malicious HTTP patterns such as injection-style requests. Shield is already discussed for DDoS, but which service should filter those web-layer attacks with customizable HTTP rules?
Select an answer to reveal the explanation.
Short Explanation
Picture a bouncer who reads the actual HTTP request—not just the crowd size at the door. Shield helps when traffic volume is the attack; WAF is the one that inspects and blocks nasty web requests with rules you define.
Full Explanation
For a city public-works portal under malicious HTTP patterns such as injection-style requests, AWS WAF is the service that inspects and filters web-layer traffic using customizable rules in a web ACL. WAF evaluates HTTP and HTTPS request attributes—URI paths, query strings, headers, body content, geographic origin, rate, and managed rule groups—and allows, blocks, or counts matching requests before they reach the origin application. That inspection model is exactly what municipal portal operators need when attackers probe for SQL injection, cross-site scripting, or other application-layer abuse rather than merely flooding bandwidth.
AWS Shield Standard (and Shield Advanced) address volumetric and protocol DDoS events. Shield absorbs or mitigates floods that overwhelm network capacity; it is not the primary tool for matching SQL injection signatures inside HTTP bodies. Saying Shield Standard matches injection signatures confuses DDoS protection with Layer-7 content filtering. Amazon GuardDuty analyzes CloudTrail, VPC flow logs, DNS logs, and related telemetry to produce threat findings. It is an intelligent detection service, not a volumetric flood scrubber sitting in the HTTP path, and it does not replace a web ACL that actively blocks malicious requests at the edge or load balancer. AWS Config evaluates resource configuration against rules and records compliance history; it does not rewrite application query strings at the edge and cannot stop an injection attempt mid-request.
Exam caveat: Cloud Practitioner items often pair WAF with Shield. Remember the split—WAF for HTTP exploit filtering with rules you control; Shield for DDoS. Both can protect the same public portal, but they solve different attack classes. Managed rule groups and custom rules live in WAF; enabling Shield alone does not create injection filters.
Operational check for the city: associate a web ACL with the Application Load Balancer, API Gateway stage, or CloudFront distribution that fronts the public-works portal; enable relevant AWS Managed Rules; add rate-based rules for abusive clients; log to CloudWatch or S3; and confirm blocked request metrics after a controlled test. Keep Shield enabled for DDoS resilience, but treat WAF as the HTTP-layer control plane for injection-style patterns.