ANS-C01 Rate-based rule Practice Question
A company uses AWS Shield Advanced to protect against DDoS attacks. They notice that some legitimate traffic is being throttled during a DDoS event. The security team wants to ensure that legitimate traffic from specific business partners is not affected. Which action should they take?
⚠ Common exam trap
Candidates often confuse AWS Shield Advanced and AWS WAF capabilities. Shield Advanced provides global DDoS protection but does not have application-layer rate limiting; that is handled by WAF.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.
AWS WAF allows you to create rate-based rules that can include an IP set with the partners' IPs and set a high rate limit for that specific rule, thereby excluding legitimate traffic from rate limiting while maintaining protection against DDoS. Option A is wrong because disabling rate-based rules removes protection against DDoS. Option B is wrong because increasing the global rate limit may still throttle legitimate traffic and is not a precise solution. Option C is wrong because AWS Shield Advanced does not have a whitelist for individual IPs at the application layer; IP whitelisting is done via AWS WAF.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the rate-based rule in AWS WAF during the DDoS event.
Why it's wrong here
Disabling the rate-based rule removes protection against DDoS, leaving the application vulnerable. Incorrect.
- ✗
Increase the global rate limit in AWS Shield Advanced.
Why it's wrong here
Increasing the global rate limit might still affect legitimate traffic and is not a precise way to exempt specific partners. Incorrect.
- ✗
Add the partners' IP addresses to the AWS Shield Advanced whitelist.
Why it's wrong here
AWS Shield Advanced does not have an IP whitelist at the application layer; IP allowances are handled through AWS WAF. Incorrect.
- ✓
Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.
Why this is correct
Correct. A rate-based rule with an IP set for the partners' IPs and a high rate limit ensures their traffic is not throttled while still protecting against DDoS.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.