A public API is served through an Application Load Balancer and protected by AWS WAF. The team wants AWS to automatically block clients that send too many requests from the same IP address within a short time window. Which AWS WAF feature is the best fit?

Use an AWS IAM policy on the ALB listener to deny requests when request count exceeds a threshold.

IAM policies do not evaluate dynamic request volume and time windows for incoming HTTP traffic. They control authorization based on identity, not per-source rate behavior.

Enable S3 server access logs for the bucket that stores API responses and alert on high log volume.

S3 access logs record S3 requests for auditing and investigation, not real-time edge enforcement for API requests. They do not block traffic at the WAF layer based on per-IP request rate.

Configure an AWS Lambda authorizer to reject requests after the Nth request from an IP address.

A Lambda authorizer can implement custom logic, but it is not a built-in, purpose-built rate-limiting control for WAF. Implementing accurate per-IP throttling would require additional state management and tuning, which is more complex and less efficient than WAF rate-based rules.

What does this SAA-C03 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Use a rate-based rule in AWS WAF to block when requests per IP exceed a configured threshold over the WAF rate-based evaluation window. — AWS WAF rate-based rules are specifically intended to limit request rates for a defined scope such as a source IP address. They measure incoming request volume over the WAF rate-based evaluation period and allow you to apply an action (for example, Block) when the configured threshold is exceeded. This directly matches the requirement to block high request volume from the same IP within a short window. Other options (IAM, S3 logs, custom authorizers) either cannot perform request-rate enforcement at the edge or do not provide automatic blocking based on per-IP thresholds. IAM cannot enforce request-rate thresholds over time for web/API traffic. S3 server access logs are for S3 request auditing and do not provide edge blocking for API requests. Lambda authorizers can deny requests, but they require custom stateful logic to count per-IP requests, making them a less direct and more complex solution than WAF rate-based controls.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.