SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Associate an AWS WAF web ACL with the CloudFront distribution.

  Why this is correct

  AWS WAF is the correct service for filtering HTTP(S) requests based on patterns such as SQL injection, bad bots, and rate-based abuse. When associated with CloudFront, the filtering happens at the edge before traffic reaches the ALB and origin, reducing load and blocking malicious requests earlier in the path. Shield Standard is already included for basic DDoS protection, but WAF is the component that provides the application-layer controls needed here.

• ✗

  Add an inbound security group rule to the ALB for the attacker IP ranges.

  Why it's wrong here

  Security groups act as a virtual firewall at the ENI/instance level and only evaluate packet attributes such as source IP, port, and protocol; they cannot decode HTTP requests or inspect bodies for SQL injection patterns. In a CloudFront architecture, the ALB's security group sees CloudFront edge IPs rather than the original client address, so adding rules for attacker IP ranges would not reliably filter the true source and would instead risk blocking legitimate edge traffic. This makes the approach both ineffective for content-based attacks and operationally fragile.

  When this WOULD be correct

  If the question asked to block all traffic from a specific IP range at the network level before it reaches the ALB, adding an inbound security group rule denying that IP range would be correct. For example: 'Block all requests from a known malicious IP range at the ALB.'

• ✗

  Use a network ACL to inspect and block SQL statements in the request body.

  Why it's wrong here

  Network ACLs are stateless packet filters applied at the subnet boundary; they inspect only IP addresses, ports, and protocol flags, not the payload of TCP segments or HTTP content. Because SQL injection attacks are embedded in the HTTP request body, which may span multiple TCP segments and require stream reassembly, a NACL has no visibility into the statements and cannot block them. Additionally, as a stateless filter, it would need explicit allow rules for return traffic, further complicating any attempt to use it for application-layer defense.

  When this WOULD be correct

  A question asks to block traffic from a specific IP range at the subnet boundary for a VPC, where application-layer inspection is not required.

• ✗

  Enable Amazon KMS encryption on the ALB listener certificates.

  Why it's wrong here

  Amazon KMS is a key management service for encrypting data at rest; it is not a feature that can be 'enabled on' TLS listener certificates, which are managed by AWS Certificate Manager. Even if you enabled HTTPS on the ALB, TLS only protects data in transit and does nothing to examine or block the decrypted HTTP request payload containing SQLi. Thus, while encryption is important for confidentiality, it neither inspects traffic nor reduces the volume of malicious requests, so it does not mitigate the attack.

  When this WOULD be correct

  A question asks how to enforce encryption for data in transit between the ALB and clients, or to meet compliance requirements for TLS termination using customer-managed keys, where the ALB must use certificates encrypted with KMS.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question