The correct answer is: Implement AWS WAF and associate it with the Application Load Balancer.

AWS WAF (Web Application Firewall) is a fully managed service that integrates directly with ALBs. It provides preconfigured rule groups and customizable filtering to defend against application-layer threats such as SQL injection and XSS. Because it is managed by AWS, it significantly reduces the operational responsibilities around patching, updating, and maintaining infrastructure. This makes it the best fit for organizations with limited security or operations teams.

Why the other options are incorrect:

Hosting the application using Amazon S3 with public access enabled is only suitable for serving static websites, not dynamic backends typically served behind ALBs. This approach does not address traffic filtering or security for backend logic, and it exposes the content to the public without security controls.

Enabling AWS Shield Advanced and adding the ALB as a protected resource helps mitigate DDoS attacks but does not specifically address application-layer threats like XSS or SQL injection. It's also a premium service with more complex configuration and cost, which may not suit smaller teams focused on application-level protection.

Routing traffic through a third-party firewall on an EC2 instance before reaching the ALB increases the operational burdencontradicting the goal of reducing server maintenance. This option introduces more infrastructure to manage and maintain, which is not desirable for a small team.

Why this question matters: It highlights the importance of choosing the right managed service based on the type of attack and the team's ability to manage infrastructure. Understanding the difference between network-layer (e.g., DDoS) and application-layer (e.g., XSS, SQLi) threats is essential when selecting security solutions on AWS.

Tip: If the question focuses on preventing application-layer attacks with minimal overhead, AWS WAF is almost always the most appropriate answerespecially when integrated directly with an ALB.

Full AWS Practitioner Certification Question