Q79 — AWS SAA-C03 Ch.17

Question 79 of 89 | ← Chapter 17

Q1379. A company website runs on Amazon EC2 instances behind an Application Load Balancer(ALB). The instances run in an Auto Scaling group across multiple Availability Zones. There is an Amazon CloudFront distribution in front of the ALB. Users are reporting performance problems. A solutions architect discovers that the website is receiving a high rate of unwanted requests to the CloudFront distribution originating from a series of source IP addresses.How should the solutions architect address this problem?

Correct Answer: D. Using AWS WAF, configure a web ACL rate-based rule on the CloudFront distribution with a rate limit below that of the unwanted requesters.

Explanation

Let's analyze each option to determine the best way for the solutions architect to address the problem of high - rate unwanted requests to the CloudFront distribution:Option AAWS Shield: AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. It provides two tiers: Standard and Advanced. While AWS Shield can help protect against DDoS attacks, it is not primarily designed for blocking specific source IP addresses through deny rules with IP match conditions. Its main focus is on mitigating large - scale, distributed attacks rather than individual IP - based blocking.So, this option is incorrect.Option BAuto Scaling: Configuring the maximum instance value in the Auto Scaling group to an increased count will only make the EC2 instances absorb more of the unwanted requests. This does not solve the root problem of the unwanted traffic. It will lead to increased costs as more instances are running to handle the unnecessary load, and the performance of the website may still be affected due to the continued presence of unwanted requests. So, this option is incorrect.Option CAmazon VPC network ACL: Amazon VPC network ACLs operate at the subnet level. CloudFront is a global service that operates outside of the VPC. Network ACLs cannot be used to block traffic at the CloudFront distribution level. They are used to control inbound and outbound traffic to subnets within a VPC. So, this option is incorrect.Option DAWS WAF: AWS WAF is a web application firewall that helps protect web applications running on AWS services such as Amazon CloudFront, Application Load Balancer, and Amazon API Gateway. Web ACL rate - based rule: By configuring a web ACL rate - based rule on the CloudFront distribution with a rate limit below that of the unwanted requesters, AWS WAF can block requests from IP addresses that exceed the specified rate limit. This effectively filters out the high - rate unwanted requests while allowing legitimate traffic to pass through. This is an appropriate solution for addressing the performance problems caused by unwanted requests. So, this option is correct.Therefore, the solutions architect should address the problem by using AWS WAF to configure a web ACL rate - based rule on the CloudFront distribution with a rate limit below that of the unwanted requesters, and the answer is D.