A company runs a public web application on Amazon EKS behind Amazon CloudFront and an Application Load Balancer (ALB). A security engineer must send a notification to an existing Amazon SNS topic…

Question

Options

• AConfigure CloudFront standard logging and CloudWatch Logs metric filters.
• BConfigure VPC Flow Logs and CloudWatch Logs metric filters.
• CConfigure an AWS WAF web ACL with an ASN match rule and CloudWatch alarms.
• DConfigure an AWS WAF web ACL with a rate-based rule. Associate it with CloudFront. Create a

• A
  4% (2)
• B
  5% (3)
• C
  13% (7)
• D
  79% (44)

Explanation

Explanation

Option D is correct because AWS WAF rate-based rules are specifically designed to count requests from individual IP addresses within a rolling 5-minute window, and when a threshold is crossed, WAF can trigger a CloudWatch alarm that publishes to an SNS topic - making this the most direct and purpose-built solution for IP-based rate limiting with notifications. Option A (CloudFront standard logging with CloudWatch metric filters) is incorrect because standard logs are delivered with significant delay and are not suitable for near-real-time detection of request thresholds. Option B (VPC Flow Logs) is wrong because Flow Logs capture network-level metadata, not HTTP request counts, and lack the granularity needed to count application-layer requests per IP. Option C is a distractor because ASN (Autonomous System Number) match rules identify network providers or organizations, not individual end-user IP addresses, making it unsuitable for per-IP rate tracking.

Memory Tip: Think WAF = Rate-Based Rules for IP throttling. Whenever an exam question involves counting requests per IP within a time window and triggering alerts, AWS WAF's rate-based rule is always the go-to answer - it's the only AWS service with this capability built-in natively.

No community discussion yet for this question.