SAA-C03 Practice Question 11: WAF Rate Based Rule
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 2 · question 1 of 10
During a product launch, a web application behind an Application Load Balancer slows to a crawl. The access logs show an HTTP request flood coming from a few thousand constantly changing IP addresses, each sending hundreds of requests a minute. Legitimate users rarely send more than 50 requests in any five-minute period.
The team needs to automatically block any single IP address that exceeds a request threshold, without maintaining a list of addresses by hand. What should the architect do?
Show answer and explanation
Answer:
An AWS WAF rate-based rule counts incoming requests per aggregation key, the source IP address is the classic choice, over an evaluation window (60, 120, 300, or 600 seconds; 300 is the default) and applies the rule action, such as Block, to additional requests from any IP that exceeds the limit. IPs are tracked and rate-limited automatically as they appear, so a flood from thousands of rotating addresses is handled without anyone maintaining a list, and legitimate users far below the threshold are unaffected. A web ACL attaches directly to an Application Load Balancer.
Option B is impossible: security groups only have allow rules. You cannot write a deny rule in a security group at all.
Option C can technically deny specific addresses, but network ACLs have a per-ACL rule quota (20 inbound and 20 outbound rules by default, adjustable to at most 40 each) and are managed by hand. Thousands of constantly changing IPs cannot be kept up to date this way, which is exactly the manual list the requirement rules out.
Option D is a real protection but the wrong layer. Shield Standard defends against common network- and transport-layer (layer 3/4) attacks such as SYN floods. A flood of well-formed HTTP requests is a layer 7 problem, and throttling it by request rate is a WAF feature.
References: Rate-based rule high-level settings in AWS WAF; Amazon VPC quotas