Q33 — AWS SAA-C03 Ch.17

Question 33 of 89 | ← Chapter 17

Q1333. A company is moving a legacy data processing application to the AWS Cloud. The application needs to run on Amazon EC2 instances behind an Application Load Balancer(ALB). The application must handle incoming traffic spikes and continue to work in the event of an application fault in one Availability Zone. The company requires that a Web Application Firewall(WAF) must be attached to the ALB.Which solution will meet these requirements?

Correct Answer: B. Deploy the application to EC2 instances in an Auto Scaling group across multiple Availability Zones. Use an Application Load Balancer(ALB) to distribute traffic across the EC2 instances. Use AWS WAF to associate a web ACL with the ALB.

Explanation

Correct Answer: BDeploy the application to EC2 instances in an Auto Scaling group across multiple Availability Zones. Use an Application Load Balancer (ALB) to distribute traffic across the EC2 instances. Use AWS WAF to associate a web ACL with the ALB.Why This Solution Meets All Requirements?The company needs a scalable, highly available, and secure architecture for its legacy data processing application. Let's break down how Option B satisfies each requirement:\1. Handles Incoming Traffic Spikes (Scalability)Auto Scaling Group (ASG) across multiple AZs automatically adjusts the number of EC2 instances based on traffic demand.If traffic increases, ASG launches new instances; if traffic decreases, it terminates unused instances, optimizing cost and performance.\2. Continues Working if an AZ Fails (High Availability)Multi-AZ deployment ensures that if one Availability Zone (AZ) becomes unavailable, traffic is automatically rerouted to healthy instances in other AZs.The Application Load Balancer (ALB) distributes traffic across all healthy instances, preventing downtime.\3. Web Application Firewall (WAF) ProtectionAWS WAF is integrated with ALB (not NLB or Route 53) to filter and block malicious traffic (e.g., SQL injection, XSS attacks).A Web Access Control List (Web ACL) defines rules to protect the application from common web exploits. \4. Correct Load Balancer Choice (ALB vs. NLB vs. Route 53) ALB is the best choice because:Operates at Layer 7 (HTTP/HTTPS), enabling advanced routing (e.g., path-based, host-based). Supports AWS WAF integration (unlike NLB, which operates at Layer 4). Route 53 latency-based routing (Option C) is unnecessary for intra-region failover and doesn't support WAF directly.Why Other Options Fail?A. Single Availability Zone DeploymentNo high availability--If the single AZ fails, the application goes down.Correct WAF integration, but fails on fault tolerance.C. Multi-Region with Route 53 Latency RoutingOverkill for AZ-level failover--Multi-region is for global resilience, not local AZ failures. AWS WAF cannot be attached to Route 53--WAF only works with ALB/CloudFront/API Gateway. Higher cost and complexity--Unnecessary for the given requirements.D. Network Load Balancer (NLB) with WAFAWS WAF does not support NLB--WAF only works with ALB, CloudFront, and API Gateway. NLB operates at Layer 4 (TCP/UDP)--Lacks advanced routing features of ALB.Final Architecture DiagramInternetAWS WAF (Web ACL) AWS WAF (Web ACL)Application Load Balancer Application Load Balancer(ALB - Multi-AZ) (ALB - Multi-AZ)Auto Scaling Group (AZ-A) Auto Scaling Group (AZ-B)EC2 EC2 EC2 EC2Key TakeawaysMulti-AZ Auto Scaling Group High availability & scalability ALB + AWS WAF Secure traffic distribution & protectionAvoid single-AZ, NLB, or Route 53-based WAF for this use case.This solution ensures the application remains scalable, highly available, and secure while meeting all stated requirements.