Based on the exhibit, a public API is behind CloudFront and is experiencing bursts of requests from the same client IP, causing upstream saturation. The team wants AWS to automatically block that IP when the request rate becomes excessive while keeping enforcement as close to the client as possible. Which control should they add?

Add a network ACL rule that denies the source IP after five requests are observed.

Network ACLs are stateless, subnet-level packet filters. They cannot count HTTP requests, apply sliding-window thresholds, or dynamically change based on application-layer behavior. They also do not sit at the CloudFront edge, so they cannot satisfy the requirement to automatically mitigate excessive request rates at the edge.

Enable AWS Shield Advanced and create a custom protection group for the single IP address.

AWS Shield Advanced is designed for DDoS detection and mitigation, especially for volumetric and infrastructure-layer attacks. It does not provide the direct HTTP request-rate thresholding and IP-based blocking behavior required here. For edge HTTP filtering and automatic rate limiting, AWS WAF rate-based rules are the correct service.

Place the API behind a security group rule that allows only the current client IP range.

Security groups are static, stateful network controls for ENIs. They do not inspect HTTP request rates or react to bursts of traffic from a single IP. They also cannot implement edge-based application-layer blocking for a CloudFront-fronted API.

What does this SAA-C03 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Add an AWS WAF rate-based rule to the CloudFront distribution and configure it to block the source IP after the threshold is exceeded. — AWS WAF rate-based rules are the right fit because they operate at the HTTP request layer and can automatically block traffic from a source IP after the configured threshold is exceeded. By attaching the Web ACL to the CloudFront distribution, the control is enforced at the edge before requests reach the application origin. That directly addresses the saturation problem with a managed, application-aware control. Network ACLs and security groups cannot inspect request rates or apply threshold logic. Shield Advanced focuses on DDoS mitigation rather than simple per-IP HTTP throttling. AWS WAF is the AWS service designed for request-level filtering and automated blocking based on request behavior, so it is the best answer here.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.