A company runs a public web application on EC2 instances behind an internet-facing Application Load Balancer. The security team wants to block requests containing common SQL injection and cross-site scripting patterns before they reach the instances, and to throttle any single source IP that exceeds a request-rate threshold. Which AWS service should be associated with the load balancer to meet these requirements with the least operational effort?
- AConfigure a network ACL on the public subnets to inspect HTTP request bodies and deny those that match injection signatures or arrive too frequently.
- BTighten the instance security groups so that inbound rules drop any HTTP request that carries SQL keywords or originates from a high-volume client address.
- CEnable AWS Shield Standard on the load balancer and rely on its rules to filter injection traffic and rate-limit abusive source addresses.
- DAttach AWS WAF to the Application Load Balancer with managed rule groups for common exploits and a rate-based rule keyed on source IP. Correct
Why A is wrong: Network ACLs filter only on IP, protocol and port at Layer 3 and 4, so they cannot inspect HTTP payloads for injection patterns or apply per-IP request-rate limits.
Why B is wrong: Security groups are stateful Layer 3 and 4 filters on IP, protocol and port, so they cannot parse HTTP content for injection strings or count request rates per client.
Why C is wrong: Shield Standard defends against network and transport layer DDoS floods automatically but does not inspect HTTP payloads or provide configurable application-layer rate-based rules.
Why D is correct: AWS WAF inspects Layer 7 HTTP requests, ships AWS managed rule groups for SQL injection and cross-site scripting, and supports rate-based rules per source IP, all attachable directly to an ALB.