nerdexam
Amazon

SCS-C02 · Question #67

A company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application has become the target of a DoS attack. Application logging shows that…

The correct answer is A. Create an AWS WAF rate-based rule, and attach it to the ALB. AWS WAF rate-based rules automatically track request rates per IP and block offenders without manual intervention, making it ideal for DoS attacks with rotating source IPs.

Submitted by kim_seoul· Mar 6, 2026Infrastructure Security

Question

A company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application has become the target of a DoS attack. Application logging shows that requests are coming from a small number of client IP addresses, but the addresses change regularly. The company needs to block the malicious traffic with a solution that requires the least amount of ongoing effort. Which solution meets these requirements?

Options

  • ACreate an AWS WAF rate-based rule, and attach it to the ALB.
  • BUpdate the security group that is attached to the ALB to block the attacking IP addresses.
  • CUpdate the ALB subnet's network ACL to block the attacking client IP addresses.
  • DCreate an AWS WAF rate-based rule, and attach it to the security group of the EC2 instances.

How the community answered

(23 responses)
  • A
    83% (19)
  • B
    9% (2)
  • C
    4% (1)
  • D
    4% (1)

Why each option

AWS WAF rate-based rules automatically track request rates per IP and block offenders without manual intervention, making it ideal for DoS attacks with rotating source IPs.

ACreate an AWS WAF rate-based rule, and attach it to the ALB.Correct

A WAF rate-based rule attached to the ALB automatically identifies and blocks IP addresses exceeding a configurable request threshold, continuously adapting to new IPs without manual updates, satisfying the least-ongoing-effort requirement.

BUpdate the security group that is attached to the ALB to block the attacking IP addresses.

Manually updating security groups each time the attacker rotates IP addresses requires continuous human effort, violating the least-effort requirement.

CUpdate the ALB subnet's network ACL to block the attacking client IP addresses.

Manually editing subnet NACLs to block individual or ranges of changing IPs is a repetitive manual task that does not scale with rotating attack IPs.

DCreate an AWS WAF rate-based rule, and attach it to the security group of the EC2 instances.

AWS WAF web ACLs attach to ALB, CloudFront, or API Gateway, not directly to EC2 security groups; this attachment point is architecturally incorrect.

Concept tested: AWS WAF rate-based rules for DDoS mitigation

Source: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

Topics

#AWS WAF#rate-based rules#DoS mitigation#ALB protection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SCS-C02 Practice