Question

A retail company hosts its customer-facing web application on public-cloud virtual machines. Security wants to inspect inbound HTTP/HTTPS traffic for SQL injection and cross-site scripting, apply OWASP Top 10 rule sets, and enable virtual patching without redesigning the application or forcing all traffic through the on-premises data center. Which cloud security capability and deployment approach best meets these requirements?

Accepted Answer

Deploy a cloud-based Web Application Firewall (WAF) in front of the web tier and enable a managed OWASP rule set with custom signatures

Answer

Enable cloud provider network flow logs and analyze them in a SIEM to detect injection attempts

Answer

Apply security-group rules that permit only TCP 443 to the web VMs from the Internet

Answer

Deploy host-based full-disk encryption on the web VMs to protect application data