Courseiva
← SAA-C03
Full test
Design Secure Architectures →hardMultiple ChoiceObjective-mapped

SAA-C03 Design Secure Architectures Practice Question

Exhibit

{
  "cloudfront_log_sample": [
    "2026-04-27T09:14:01Z c-ip=203.0.113.44 uri=/api/search 1",
    "2026-04-27T09:14:02Z c-ip=203.0.113.44 uri=/api/search 1",
    "2026-04-27T09:14:02Z c-ip=203.0.113.44 uri=/api/search 1"
  ],
  "origin_metrics": {
    "5xxErrorRate": "spiking",
    "ALBRequestCount": "high",
    "single_source_ip_percentage": "82%"
  },
  "waf_status": "No Web ACL associated with the CloudFront distribution"
}

Based on the exhibit, a public API is behind CloudFront. A single client IP is sending bursts of requests that are overwhelming the origin, and the team wants AWS to automatically mitigate the abuse at the edge without changing the application code. What should the team do?

⚠ Common exam trap

Watch out — candidates often confuse AWS Shield Advanced's automatic DDoS mitigation (which handles network/transport layer floods) with the need for a WAF rate-based rule to stop application-layer request bursts from a single IP.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Associate an AWS WAF web ACL with CloudFront and add a rate-based rule for the offending IP behavior.

AWS WAF rate-based rules automatically block or rate-limit requests from a client IP when the request rate exceeds a threshold you define. By associating the web ACL with CloudFront, the rule is enforced at the edge before traffic reaches the origin, mitigating abuse without modifying application code.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Associate an AWS WAF web ACL with CloudFront and add a rate-based rule for the offending IP behavior.

    Why this is correct

    AWS WAF is the right control at the CloudFront edge because it can inspect requests before they reach the origin and enforce a rate-based rule on abusive traffic patterns. A rate-based rule can automatically count requests by source IP and block or challenge requests that exceed the configured threshold, which directly addresses the burst traffic shown in the logs. This meets the requirement to mitigate at the edge without any application changes.

  • ✗

    Increase the ALB idle timeout to allow the origin to absorb more concurrent requests.

    Why it's wrong here

    ALB idle timeout affects how long an existing connection can remain open, not how many requests a hostile client can generate. Increasing it may actually increase resource consumption at the origin instead of stopping the abuse.

  • ✗

    Add an Amazon Route 53 health check to fail over traffic to another DNS name.

    Why it's wrong here

    Route 53 health checks and failover are used for endpoint availability and regional failover, not for filtering or rate-limiting abusive requests from a single client IP. This would not stop the malicious traffic from reaching the origin.

  • ✗

    Enable AWS Shield Advanced and rely on automatic DDoS protection for all request bursts.

    Why it's wrong here

    AWS Shield Advanced is useful for broader DDoS resiliency, especially for large-scale network and transport layer attacks, but the precise control for this HTTP request pattern is AWS WAF with a rate-based rule. The scenario calls for request-level edge filtering, not only infrastructure-level DDoS protection.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.