ANS-C01 Network Design Practice Question
A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a web ACL in AWS WAF and associate it with the ALB.
AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level. Option D is incorrect because WAF is not a Network Load Balancer feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a web ACL in AWS WAF and associate it with the ALB.
Why this is correct
WAF can be associated with ALB to filter HTTP/HTTPS requests.
- ✗
Replace the ALB with a Network Load Balancer and use AWS WAF with it.
Why it's wrong here
WAF cannot be associated with NLB directly.
- ✗
Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.
Why it's wrong here
Security groups do not integrate with WAF.
- ✗
Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.
Why it's wrong here
Placing AWS WAF before CloudFront introduces an additional CDN hop that is unnecessary here, because the ALB is already internet-facing and directly reachable; the requirement is to filter requests at the ALB itself, not to add a content-delivery layer. This option is tempting because AWS WAF integrated with CloudFront is a common pattern for protecting web applications that already use CloudFront for caching and edge termination, and it would be correct if the application were served through CloudFront rather than directly via an internet-facing ALB.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.