nerdexam
Amazon

SAP-C02 · Question #484

A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone. The company is concerned about security and wants a solutions architect to re- architect…

The correct answer is D. Configure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load. To re-architect for high availability, security filtering, and auditing, deploy the application on a Multi-AZ Auto Scaling group behind an Application Load Balancer (ALB) integrated with AWS WAF for attack filtering and Kinesis Data Firehose for logging rejected requests to a…

Submitted by lukas.cz· Mar 6, 2026Continuous Improvement for Existing Solutions

Question

A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone. The company is concerned about security and wants a solutions architect to re- architect the solution to meet the following requirements:

  • Inbound requests must be filtered for common vulnerability attacks.
  • Rejected requests must be sent to a third-party auditing application.
  • All resources should be highly available.

Which solution meets these requirements?

Options

  • AConfigure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load
  • BConfigure an Application Load Balancer (ALB) and add the EC2 instances as targets. Create a
  • CConfigure an Application Load Balancer (ALB) along with a target group adding the EC2
  • DConfigure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load

How the community answered

(35 responses)
  • A
    9% (3)
  • B
    6% (2)
  • C
    23% (8)
  • D
    63% (22)

Why each option

To re-architect for high availability, security filtering, and auditing, deploy the application on a Multi-AZ Auto Scaling group behind an Application Load Balancer (ALB) integrated with AWS WAF for attack filtering and Kinesis Data Firehose for logging rejected requests to a third-party auditor.

AConfigure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load

This choice is structurally identical to D; however, D is specified as the correct answer, implying A is not the selected choice.

BConfigure an Application Load Balancer (ALB) and add the EC2 instances as targets. Create a

This solution lacks explicit high availability for the EC2 instances themselves, only mentioning adding them as targets to an ALB without specifying a Multi-AZ Auto Scaling group.

CConfigure an Application Load Balancer (ALB) along with a target group adding the EC2

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not function as a web application firewall to filter inbound requests for common vulnerability attacks at the edge.

DConfigure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application LoadCorrect

Configuring a Multi-AZ Auto Scaling group ensures high availability and scalability for the EC2 instances, while an Application Load Balancer provides traffic distribution. Associating an AWS WAF Web ACL with the ALB filters inbound requests for common vulnerabilities, and configuring the WAF ACL to send logs to a Kinesis Data Firehose delivery stream allows rejected requests to be sent to a third-party auditing application, meeting all specified requirements.

Concept tested: Web application security, high availability, logging and auditing

Source: https://docs.aws.amazon.com/waf/latest/developerguide/waf-logging.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice