SAA-C03 Q396 · Security

Question

A company runs an application on a group of Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to protect the application against layer 7 DDoS attacks. Which solution will meet this requirement?

Accepted Answer

**Option C: Create an AWS WAF web ACL with an AWS managed rule and associate it with the ALB.**

Let's break down the requirements:

1. **Layer 7 (Application Layer) DDoS protection** — This means HTTP/HTTPS-level attacks like HTTP floods, slowloris, and bot-driven request floods. Layer 7 attacks require intelligent inspection of HTTP requests, not just network-level filtering.

2. **AWS WAF is purpose-built for Layer 7 protection** — AWS WAF inspects HTTP/HTTPS requests at the application layer, making it the correct service for this use case.

3. **AWS Managed Rules are the key differentiator** — AWS provides pre-built managed rule groups specifically designed for common threats, including:
   - **Amazon IP Reputation List** — blocks known malicious IPs
   - **Anonymous IP List** — block

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips