CLF-C02 Security and Compliance Practice Question
A company runs a web application on Amazon CloudFront and an Application Load Balancer (ALB). The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS). Additionally, the company needs to block requests from specific countries due to compliance requirements. The security team prefers a managed service that provides pre-configured rule sets and integrates directly with CloudFront and ALB without requiring additional infrastructure. Which AWS service should the security team use?
⚠ Common exam trap
Many exam-takers confuse AWS WAF with AWS Shield Advanced, thinking Shield Advanced provides application-layer attack protection, but Shield Advanced focuses on DDoS mitigation at the network and transport layers, not on inspecting HTTP payloads for SQL injection or XSS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF
AWS WAF is a managed web application firewall that protects web applications from common exploits like SQL injection and cross-site scripting (XSS) using pre-configured rule sets (e.g., AWS Managed Rules). It integrates natively with both CloudFront and Application Load Balancers (ALBs) without requiring additional infrastructure, and it supports geo-blocking to restrict requests from specific countries, meeting all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Network Firewall
Why it's wrong here
AWS Network Firewall is a managed service for VPC-level traffic filtering and inspection, protecting network boundaries. It does not provide application-layer web attack protection (SQL injection, XSS) or native integration with CloudFront and ALB for web application rules.
When this WOULD be correct
A company needs to protect a VPC-based workload (e.g., EC2 instances) from network-level threats like port scanning or DDoS, and requires stateful inspection of all traffic entering or leaving the VPC, with no need for application-layer filtering.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced is a managed DDoS protection service that defends applications against network and transport-layer attacks, such as UDP floods and SYN floods, as well as some layer 7 anomalies, for resources like CloudFront and Application Load Balancers. However, it is not a configurable web application firewall and has no rule engine to inspect HTTP request payloads for SQL injection or cross-site scripting, nor can it enforce geographic blocking based on country codes. Because the question specifically requires application-layer filtering for SQLi, XSS, and geo-blocking, Shield Advanced alone cannot satisfy these requirements, even though it can complement AWS WAF in a layered security design.
When this WOULD be correct
A company needs protection against large-scale DDoS attacks targeting their CloudFront distribution and ALB, and requires 24/7 access to the DDoS Response Team (DRT) for mitigation. They also want cost protection from scaling due to DDoS attacks.
- ✓
AWS WAF
Why this is correct
AWS WAF is a web application firewall that protects against common web exploits like SQL injection and XSS. It supports pre-configured managed rule sets, custom rules, and geographic (geo) blocking. It integrates directly with Amazon CloudFront and Application Load Balancer, meeting all the requirements.
- ✗
AWS Firewall Manager
Why it's wrong here
AWS Firewall Manager is a security management service that centrally configures and monitors firewall rules (including AWS WAF rules) across accounts and resources. However, it does not itself provide the web application filtering or geo-blocking capabilities; it manages the underlying WAF rules. The primary service that performs the described protection is AWS WAF.
When this WOULD be correct
A company with multiple AWS accounts and resources wants to centrally deploy and manage AWS WAF rules across all accounts and resources, including CloudFront distributions and ALBs, to enforce consistent security policies. The security team needs a single tool to define and apply web ACLs across the organization, not to create the rules themselves.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS WAFCorrect answer▾
Why this is correct
AWS WAF is a web application firewall that protects against common web exploits like SQL injection and XSS. It supports pre-configured managed rule sets, custom rules, and geographic (geo) blocking. It integrates directly with Amazon CloudFront and Application Load Balancer, meeting all the requirements.
✗AWS Network FirewallWrong answer — click to see why▾
Why this is wrong here
AWS Network Firewall is a managed firewall for VPCs that filters traffic at the network and transport layers (Layer 3-4), not at the application layer. It cannot inspect HTTP requests for SQL injection or XSS, nor does it integrate directly with CloudFront or ALB for web ACLs.
★ When this WOULD be the correct answer
A company needs to protect a VPC-based workload (e.g., EC2 instances) from network-level threats like port scanning or DDoS, and requires stateful inspection of all traffic entering or leaving the VPC, with no need for application-layer filtering.
Why candidates choose this
Candidates may assume 'Network Firewall' is a general-purpose firewall that can handle all security needs, including web attacks, due to its name and managed nature, overlooking that it lacks application-layer inspection capabilities.
✗AWS Shield AdvancedWrong answer — click to see why▾
Why this is wrong here
AWS Shield Advanced provides DDoS protection but does not include pre-configured rule sets for SQL injection or XSS, nor does it offer geo-blocking capabilities. It also does not integrate directly with ALB for application-layer filtering.
★ When this WOULD be the correct answer
A company needs protection against large-scale DDoS attacks targeting their CloudFront distribution and ALB, and requires 24/7 access to the DDoS Response Team (DRT) for mitigation. They also want cost protection from scaling due to DDoS attacks.
Why candidates choose this
Candidates may confuse Shield Advanced with WAF because both are security services, and Shield Advanced includes WAF at no extra cost, leading them to think it provides the same application-layer protections.
✗AWS Firewall ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Firewall Manager is a policy management service that centrally configures and monitors firewall rules across accounts, but it does not itself provide the pre-configured rule sets for SQL injection or XSS protection. It manages AWS WAF rules, not the rules themselves, and does not directly integrate with CloudFront and ALB for web traffic inspection.
★ When this WOULD be the correct answer
A company with multiple AWS accounts and resources wants to centrally deploy and manage AWS WAF rules across all accounts and resources, including CloudFront distributions and ALBs, to enforce consistent security policies. The security team needs a single tool to define and apply web ACLs across the organization, not to create the rules themselves.
Why candidates choose this
Candidates may confuse Firewall Manager's ability to centrally manage WAF rules with the actual WAF service that provides the pre-configured rule sets for common web attacks, assuming Firewall Manager offers built-in protection rather than just policy management.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.