nerdexam
Amazon

SOA-C02 · Question #125

A company's public website is hosted in an Amazon S3 bucket in the us-east-1 Region behind an Amazon CloudFront distribution. The company wants to ensure that the website is protected from DDoS…

The correct answer is A. Deploy a global-scoped AWS WAF web ACL with an allow default action. https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-default-action.html

Submitted by joshua94· Mar 30, 2026Security and Compliance

Question

A company's public website is hosted in an Amazon S3 bucket in the us-east-1 Region behind an Amazon CloudFront distribution. The company wants to ensure that the website is protected from DDoS attacks. A SysOps administrator needs to deploy a solution that gives the company the ability to maintain control over the rate limit at which DDoS protections are applied. Which solution will meet these requirements?

Options

  • ADeploy a global-scoped AWS WAF web ACL with an allow default action.
  • BDeploy an AWS WAF web ACL with an allow default action in us-east-1.
  • CDeploy a global-scoped AWS WAF web ACL with a block default action.
  • DDeploy an AWS WAF web ACL with a block default action in us-east-1.

How the community answered

(40 responses)
  • A
    70% (28)
  • B
    10% (4)
  • C
    5% (2)
  • D
    15% (6)

Explanation

https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-default-action.html

Topics

#AWS WAF#DDoS protection#CloudFront#web ACL

Community Discussion

No community discussion yet for this question.

Full SOA-C02 Practice