Exempt Partner IPs from WAF Rate-Based Rules

• A.Add the partner IPs to a Network ACL allow rule in the VPC.
• B.Remove the blocking WAF rules and rely on Shield Advanced only.
• C.Add the partner IPs to an AWS Shield Advanced IP whitelist.
• ✓ D.Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.

Why D: Option D is correct because AWS WAF allows you to create an IP set containing the partner IP addresses and then add a rule with a higher priority than the blocking rules to allow traffic from that IP set. This ensures that partner traffic is explicitly allowed even if other rules would block it. Option A is incorrect because Network ACLs operate at the subnet level and are not evaluated by AWS WAF for application-layer traffic; they also do not have a whitelist feature within WAF. Option B is incorrect because removing blocking rules would leave the application vulnerable; Shield Advanced provides DDoS protection but does not replace WAF rule logic. Option C is incorrect because AWS Shield Advanced does not have an IP whitelist feature; it focuses on mitigating DDoS attacks, not on application-layer allowlisting.

• A.Disable rate-based rules during the attack
• B.Use Shield Advanced automatic application layer DDoS mitigation
• ✓ C.Create an AWS WAF rule with an IP set that allows the known IPs, and place it before the rate-based rule
• D.Create an allow list in AWS Shield Advanced to exempt the IPs from all protections

Why C: Option C is correct because AWS WAF rules can be configured with IP sets to allow traffic from specific IPs before applying rate-based rules. Option A is wrong because Shield Advanced does not support custom allow lists directly; it works with WAF. Option B is wrong because disabling rate-based rules would remove protection for all traffic. Option D is wrong because Shield Advanced does not have a bypass feature; it uses WAF for custom rules.