You are a DevOps engineer in a company. There will be a security audit in the company and the security team asks you to provide evidence that the web applications in AWS are protected from the most critical attacks mentioned in “Open Web Application Security Project (OWASP) Top 10”. For example, web application vulnerabilities such as SQL injection and Cross-Site Scripting (XSS) should be mitigated by an approach. This approach should also be cost-effective and simple to implement. Which of the following options would you select?

Answer options:

A.Create a web ACL in AWS WAF and add a rule from AWS Marketplace that can mitigate and minimize the OWASP Top 10 vulnerabilities and threats.
B.Set up AWS WAF and use a CloudFormation stack to create a Web ACL along with condition types and rules to protect the web applications in AWS.
C.Enable AWS Shield Advanced which can protect the AWS EC2 instances and Lambda functions against web attacks that belong to OWASP Top 10.
D.Set up AWS Inspector and include the “OWASP Top 10” rule package in the assessment to mitigate the major vulnerabilities.

Correct Answer : B
Option A is incorrect because the solution from AWS Marketplace is not cost-effective. You can create your own rules in the Web ACL.
Option B is CORRECT because AWS WAF can help to mitigate the OWASP Top 10 threats. For the details, please check the whitepaper
Option C is incorrect because AWS Shield Advanced is mainly used to mitigate DDoS attacks. It cannot remediate all OWASP Top 10 threats.
Option D is incorrect because AWS Inspector is only used for EC2 instances and there is no “OWASP Top 10” rule package in AWS Inspector.
Reference:
https://aws.amazon.com/blogs/aws/prepare-for-the-owasp-top-10-web-application-vulnerabilities-using-aws-waf-and-our-new-white-paper/,
https://d0.awsstatic.com/whitepapers/Security/aws-waf-owasp.pdf