A municipal web form that accepts free-text comments has been hit with SQL injection attempts. Which control should the architect place on the public entry point?
Select an answer to reveal the explanation.
Short Explanation
Think of WAF as the metal detector at the form’s front door—it catches nasty payloads before they reach the clerks. Put AWS WAF on the ALB, CloudFront, or API Gateway that faces the public. Opening the database to the world or turning off logs is how injection walks right in.
Full Explanation
AWS WAF evaluates HTTP(S) requests against rules that can detect common exploits such as SQL injection and cross-site scripting at supported front doors including ALB, CloudFront, and API Gateway. Edge filtering complements secure coding; it does not replace parameterized queries, but it reduces exploit volume against public forms. Exposing RDS to anonymous SQL clients, disabling logging, or removing validation increases risk instead of mitigating injection attempts.