nerdexam
Amazon

SAP-C02 · Question #515

An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container Service (Amazon ECS) cluster in an Auto Scaling group…

The correct answer is B. Create an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. Connect. To efficiently prevent an authentication service from being overwhelmed by a weekly spike of failed login attempts from changing IP addresses, an AWS WAF web ACL with a rate-based rule should be configured to automatically block traffic exceeding a defined threshold.

Submitted by eva_at· Mar 6, 2026Continuous Improvement for Existing Solutions

Question

An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container Service (Amazon ECS) cluster in an Auto Scaling group behind an Application Load Balancer (ALB). A system administrator detects a weekly spike in the number of failed login attempts, which overwhelm the application's authentication service. All the failed login attempts originate from about 500 different IP addresses that change each week. A solutions architect must prevent the failed login attempts from overwhelming the authentication service. Which solution meets these requirements with the MOST operational efficiency?

Options

  • AUse AWS Firewall Manager to create a security group and security group policy to deny access
  • BCreate an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. Connect
  • CUse AWS Firewall Manager to create a security group and security group policy to allow access
  • DCreate an AWS WAF web ACL with an IP set match rule, and set the rule action to Block.

How the community answered

(22 responses)
  • A
    14% (3)
  • B
    73% (16)
  • C
    5% (1)
  • D
    9% (2)

Why each option

To efficiently prevent an authentication service from being overwhelmed by a weekly spike of failed login attempts from changing IP addresses, an AWS WAF web ACL with a rate-based rule should be configured to automatically block traffic exceeding a defined threshold.

AUse AWS Firewall Manager to create a security group and security group policy to deny access

Using AWS Firewall Manager to create a security group to deny specific IPs would require manual, weekly updates for 500 changing IP addresses, which is not operationally efficient.

BCreate an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. ConnectCorrect

An AWS WAF rate-based rule automatically identifies and blocks source IP addresses exceeding a configured request rate, effectively mitigating distributed brute-force attacks from a changing set of IP addresses with high operational efficiency.

CUse AWS Firewall Manager to create a security group and security group policy to allow access

An allow-list security group policy would restrict legitimate users from around the world and is not a viable solution for a public web application with dynamic user IPs.

DCreate an AWS WAF web ACL with an IP set match rule, and set the rule action to Block.

An AWS WAF IP set match rule requires manually specifying IP addresses to block, which is not operationally efficient given that the 500 malicious IP addresses change weekly.

Concept tested: AWS WAF Rate-based Rules, DDoS Mitigation

Source: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rate-based-rules.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice