AWS WAF Web ACL Not Evaluating Traffic: Associate with ALB
You deploy a Web ACL with an AWS WAF rate-based rule intended to limit abusive traffic to your API. After the deployment, attackers still reach the backend service. ALB access logs show requests arrive at the ALB, but WAF logs indicate the Web ACL is not evaluating those requests.
Which change most likely fixes the issue?
Quick Answer
The answer is to associate the Web ACL with the Application Load Balancer resource ARN, because AWS WAF does not automatically evaluate traffic for any resource—a Web ACL must be explicitly attached to a specific resource like an ALB, CloudFront distribution, or API Gateway for it to inspect incoming requests. In this scenario, the Web ACL was deployed but never linked to the ALB, so the rate-based rule was effectively inactive, allowing attackers to reach the backend despite the rule being configured. On the SAA-C03 exam, this tests your understanding that WAF is a separate service from the ALB itself, and a common trap is assuming that creating a Web ACL is enough to protect a resource without performing the association step. A helpful memory tip is to think of the Web ACL as a security guard who needs a specific assignment to a building—without that assignment, the guard has no authority to check anyone entering.
⚠ Common exam trap
Many exam-takers assume deploying a Web ACL automatically applies it to all resources in the account, when in fact it must be explicitly associated with each resource ARN to take effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate the Web ACL with the Application Load Balancer resource ARN so WAF evaluates requests sent to that ALB.
A Web ACL must be explicitly associated with a resource (such as an ALB) for AWS WAF to evaluate incoming requests. In this scenario, the Web ACL was deployed but not associated with the ALB resource ARN, so WAF never inspected the traffic. Associating the Web ACL with the ALB ensures that all requests to the ALB are evaluated by the rate-based rule before reaching the backend.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Associate the Web ACL with the Application Load Balancer resource ARN so WAF evaluates requests sent to that ALB.
Why this is correct
For an ALB, the Web ACL must be associated with the load balancer resource itself. If it is not attached to the ALB, WAF will not inspect those requests.
- ✗
Add a security group rule that drops inbound traffic from the attacker IP range at the instances' ENIs.
Why it's wrong here
Security groups can block traffic, but this does not fix the fact that WAF is not evaluating the requests.
When this WOULD be correct
This option would be correct in a scenario where the Web ACL is already properly associated and evaluating traffic, but attackers are still reaching the backend because the WAF rate-based rule is not effectively blocking them. In that case, adding a security group rule to drop traffic from known attacker IPs at the instance ENIs would provide an additional layer of defense.
- ✗
Create a target group stickiness policy so WAF can count requests consistently per client IP.
Why it's wrong here
Stickiness affects load balancing behavior, not whether WAF evaluates requests.
When this WOULD be correct
A question where clients report intermittent failures or inconsistent behavior from a backend that maintains state, and the solution must ensure all requests from a client go to the same target. For example: 'Users are randomly logged out when using a stateful web application behind an ALB. Which configuration ensures session persistence?'
- ✗
Enable AWS Shield Advanced but keep the Web ACL unattached because Shield automatically applies rate limiting.
Why it's wrong here
Shield protects against certain DDoS conditions, but it does not replace WAF association or WAF rate-based rules.
When this WOULD be correct
If the question described a scenario where the goal is to protect against large-scale DDoS attacks that overwhelm infrastructure, and the requirement is to get enhanced DDoS mitigation and cost protection, then enabling AWS Shield Advanced would be correct, even without a Web ACL for rate limiting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Associate the Web ACL with the Application Load Balancer resource ARN so WAF evaluates requests sent to that ALB.Correct answer▾
Why this is correct
For an ALB, the Web ACL must be associated with the load balancer resource itself. If it is not attached to the ALB, WAF will not inspect those requests.
✗Add a security group rule that drops inbound traffic from the attacker IP range at the instances' ENIs.Wrong answer — click to see why▾
Why this is wrong here
The issue is that the Web ACL is not evaluating requests at all, which indicates a missing association between the Web ACL and the ALB. Adding a security group rule to drop traffic from attacker IPs does not address the root cause—the Web ACL is not in the evaluation path—and security groups operate at the instance level, not at the ALB level for WAF inspection.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the Web ACL is already properly associated and evaluating traffic, but attackers are still reaching the backend because the WAF rate-based rule is not effectively blocking them. In that case, adding a security group rule to drop traffic from known attacker IPs at the instance ENIs would provide an additional layer of defense.
Why candidates choose this
Candidates may think that blocking attacker IPs at the instance level is a quick fix to stop abusive traffic, overlooking that the primary issue is the Web ACL not being associated with the ALB. They might also confuse the roles of security groups and WAF in traffic filtering.
✗Create a target group stickiness policy so WAF can count requests consistently per client IP.Wrong answer — click to see why▾
Why this is wrong here
Stickiness (session affinity) ensures requests from the same client are sent to the same target, but it does not cause WAF to evaluate requests. The issue is that the Web ACL is not associated with the ALB, so WAF never inspects traffic regardless of stickiness.
★ When this WOULD be the correct answer
A question where clients report intermittent failures or inconsistent behavior from a backend that maintains state, and the solution must ensure all requests from a client go to the same target. For example: 'Users are randomly logged out when using a stateful web application behind an ALB. Which configuration ensures session persistence?'
Why candidates choose this
Candidates may confuse rate-based rules (which count requests per IP) with stickiness, thinking that binding a client to one target helps WAF count requests accurately. However, WAF counts at the ALB level, not per target.
✗Enable AWS Shield Advanced but keep the Web ACL unattached because Shield automatically applies rate limiting.Wrong answer — click to see why▾
Why this is wrong here
AWS Shield Advanced does not automatically apply rate limiting; it provides DDoS protection but does not replace the need to associate a Web ACL for WAF rate-based rules. The Web ACL must be explicitly associated with a resource like an ALB to evaluate requests.
★ When this WOULD be the correct answer
If the question described a scenario where the goal is to protect against large-scale DDoS attacks that overwhelm infrastructure, and the requirement is to get enhanced DDoS mitigation and cost protection, then enabling AWS Shield Advanced would be correct, even without a Web ACL for rate limiting.
Why candidates choose this
Candidates may think Shield Advanced includes all WAF capabilities automatically, or that it can substitute for a Web ACL, due to its name implying comprehensive protection.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAA-C03
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You deploy a Web ACL with an AWS WAF rate-based rule intended to limit abusive traffic to your API. After the deployment, attackers still reach the backend service. ALB access logs show requests arrive at the ALB, but WAF logs indicate the Web ACL is not evaluating those requests. Which change most likely fixes the issue?
medium- ✓ A.Associate the Web ACL with the Application Load Balancer resource ARN so WAF evaluates requests sent to that ALB.
- B.Add a security group rule that drops inbound traffic from the attacker IP range at the instances' ENIs.
- C.Create a target group stickiness policy so WAF can count requests consistently per client IP.
- D.Enable AWS Shield Advanced but keep the Web ACL unattached because Shield automatically applies rate limiting.
Why A: The Web ACL must be explicitly associated with the ALB resource ARN for AWS WAF to evaluate incoming requests. Without this association, WAF does not inspect traffic, allowing attackers to bypass the rate-based rule and reach the backend service. Associating the Web ACL with the ALB ensures that all requests to the ALB are evaluated by the WAF rules before being forwarded to the target group.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.