SAA-C03 Q695 · Security

Question

A website runs on Amazon EC2 behind an ALB with Amazon CloudFront in front. The site is receiving a high rate of unwanted requests from specific IP addresses. How should the solutions architect address this problem?

Accepted Answer

**D. Use AWS WAF with a rate-based rule on the CloudFront distribution.**

Let's break down why this is correct by mapping each requirement:

1. **Problem: High rate of unwanted requests from specific IPs** → A rate-based rule in AWS WAF automatically tracks the request rate per IP address and blocks IPs that exceed a defined threshold. This directly addresses the problem.

2. **Architecture: CloudFront is the entry point** → AWS WAF integrates natively with CloudFront. By attaching a Web ACL to the CloudFront distribution, unwanted traffic is blocked at the **edge** — before it ever reaches the ALB or EC2 instances. This is the earliest and most efficient point to block.

3. **Specific IP addresses** → AWS WAF rate-based rules track by source IP. You can also combine rate-based rules with

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips