A cloud application must block SQL injection attempts in HTTP traffic, validate the structure of incoming SOAP messages against their schemas, and enforce per-client request quotas on its REST APIs. Which assignment of controls fits these three needs?
Select an answer to reveal the explanation.
Short Explanation
Match each tool to the job it was born for. The WAF inspects HTTP traffic for attacks like injection, the XML firewall understands XML and SOAP and checks messages against schemas, and the API gateway is the traffic cop that meters each client. Mix them up and you've got a bouncer doing the accounting.
Full Explanation
Each of these components operates at a different level of the application stack. A web application firewall inspects HTTP and HTTPS requests and responses at layer 7 and applies rules against attack patterns such as SQL injection and cross-site scripting, which makes it the right control for blocking injection attempts in web traffic. An XML firewall, sometimes called an XML gateway, parses XML payloads and enforces policies on them, including schema validation, size and depth limits, and protection against XML-specific attacks; SOAP messages are XML, so validating their structure against schemas is its specialty. An API gateway sits in front of APIs to authenticate clients, route requests, apply transformations and enforce rate limits and quotas per client or key, so per-client quotas belong there. Assigning SQL injection blocking to the gateway, SOAP validation to the WAF and quotas to the XML firewall places every function on a component not designed for it. Assigning injection to the XML firewall and quotas to the WAF does the same. Keeping the WAF for injection but swapping the gateway and XML firewall leaves quota enforcement on a component that does not meter clients. Exam caveat: products increasingly combine these functions, but the exam tests the conceptual role of each. Operational check: confirm each control is in the request path for the traffic it protects, and test it with an injection payload, an invalid SOAP message and a burst of requests.