SAA-C03 Design Secure Architectures Practice Question
A company is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. The company wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to restrict access to specific geographic regions. Which combination of AWS services should a solutions architect use to meet these requirements?
⚠ Common exam trap
Many candidates confuse network-layer firewalls with application-layer web application firewalls; only AWS WAF inspects HTTP requests for exploits and supports geographic matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF with managed rule groups and geographic match conditions.
AWS WAF is the appropriate service for protecting web applications behind an Application Load Balancer from application-layer attacks. Its managed rule groups cover common threats like SQL injection and cross-site scripting, and geographic match conditions can allow or block traffic by country. The other services either operate at different layers or provide detection rather than inline prevention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Network Firewall with stateful rule groups and domain lists.
Why it's wrong here
AWS Network Firewall operates at the VPC level and inspects traffic at layers 3 and 4, with some layer 7 inspection for domains. It is not designed to attach to an Application Load Balancer or to inspect HTTP requests for SQL injection and cross-site scripting. It also does not provide geographic match conditions for web requests.
- ✗
AWS Shield Advanced with a web ACL and IP set rules.
Why it's wrong here
AWS Shield Advanced provides protection against DDoS attacks but does not natively inspect for SQL injection or cross-site scripting. IP set rules in a web ACL are part of AWS WAF, not Shield. Shield Advanced alone does not meet the requirement for application-layer exploit protection or geographic restrictions.
- ✓
AWS WAF with managed rule groups and geographic match conditions.
Why this is correct
AWS WAF can be attached to an Application Load Balancer and provides managed rule groups that protect against common exploits like SQL injection and cross-site scripting. It also supports geographic match conditions to allow or block requests based on the country of origin. This directly addresses both requirements.
- ✗
Amazon GuardDuty with threat intelligence and custom findings.
Why it's wrong here
GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior. It does not block web exploits or enforce geographic restrictions in real time. It is an audit and detection tool, not an inline protection mechanism for web traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 935 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.