A company website runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. There is an Amazon CloudFront…

Question

Options

• AUsing AWS Shield, configure a deny rule with an IP match condition containing the source IPs of
• BUsing Auto Scaling, configure the maximum an instance value to an increased count that will
• CUsing an Amazon VPC NACL, configure an inbound deny rule for each source IP CIDR address
• DUsing AWS WAF, configure a web ACL rate-based rule on the CloudFront distribution with a rate

• A
  7% (4)
• B
  3% (2)
• C
  18% (11)
• D
  72% (43)

Explanation

Option D is correct because AWS WAF integrates natively with CloudFront and its rate-based rules automatically block source IPs that exceed a configurable request threshold - exactly the right tool to stop high-rate unwanted HTTP/S traffic at the edge before it ever reaches your ALB or EC2 instances.

Why the distractors are wrong:

• A (Shield): AWS Shield is a DDoS protection service for layers 3/4 - it has no "deny rules with IP match conditions." That capability belongs to WAF, not Shield.
• B (Auto Scaling): Scaling up instances absorbs the bad traffic rather than blocking it - expensive, ineffective, and does nothing to stop the attack source.
• C (VPC NACL): NACLs operate inside the VPC at the subnet level. By the time traffic flows from CloudFront to the ALB, the source IP is a CloudFront edge IP, not the original attacker's IP - so NACL rules based on attacker IPs would never match.

Memory tip: Think of the layers - Shield guards the perimeter against volumetric floods, WAF is the smart bouncer at the door that reads HTTP traffic and blocks bad actors by IP, rate, or pattern. Whenever the question involves CloudFront + blocking specific IPs or request patterns, WAF is almost always the answer.

No community discussion yet for this question.