Courseiva
← SAA-C03
Full test
Design Secure Architectures →hardMultiple ChoiceObjective-mapped

SAA-C03 Design Secure Architectures Practice Question

Exhibit

CloudFront access log excerpt:
2026-04-27T10:15:12Z 203.0.113.24 GET /api/orders 200 112ms
2026-04-27T10:15:12Z 203.0.113.24 GET /api/orders 200 109ms
2026-04-27T10:15:13Z 203.0.113.24 GET /api/orders 200 111ms
2026-04-27T10:15:13Z 203.0.113.24 GET /api/orders 200 108ms
2026-04-27T10:15:13Z 203.0.113.24 GET /api/orders 200 110ms

Security requirement:
- Automatically mitigate high-rate requests from a single source IP
- Keep the protection at the edge

Based on the exhibit, a public API is behind CloudFront and is experiencing bursts of requests from the same client IP, causing upstream saturation. The team wants AWS to automatically block that IP when the request rate becomes excessive while keeping enforcement as close to the client as possible. Which control should they add?

⚠ Common exam trap

Candidates often confuse stateless network ACLs or static security groups with the automatic, rate-aware blocking capability of AWS WAF, leading candidates to choose a manual or non-scalable solution.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add an AWS WAF rate-based rule to the CloudFront distribution and configure it to block the source IP after the threshold is exceeded.

AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate within a 5-minute evaluation window. By attaching this rule to a CloudFront distribution, enforcement occurs at the edge location closest to the client, preventing excessive requests from reaching the upstream API and mitigating saturation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Add an AWS WAF rate-based rule to the CloudFront distribution and configure it to block the source IP after the threshold is exceeded.

    Why this is correct

    AWS WAF rate-based rules are purpose-built for this use case. They evaluate the HTTP request rate from a source IP over a sliding window and can automatically block, CAPTCHA, or count when the threshold is exceeded. Attaching the Web ACL to CloudFront enforces the control at the edge, so abusive requests are stopped before they reach the origin and consume upstream capacity.

  • ✗

    Add a network ACL rule that denies the source IP after five requests are observed.

    Why it's wrong here

    Network ACLs are stateless, subnet-level packet filters. They cannot count HTTP requests, apply sliding-window thresholds, or dynamically change based on application-layer behavior. They also do not sit at the CloudFront edge, so they cannot satisfy the requirement to automatically mitigate excessive request rates at the edge.

  • ✗

    Enable AWS Shield Advanced and create a custom protection group for the single IP address.

    Why it's wrong here

    AWS Shield Advanced is designed for DDoS detection and mitigation, especially for volumetric and infrastructure-layer attacks. It does not provide the direct HTTP request-rate thresholding and IP-based blocking behavior required here. For edge HTTP filtering and automatic rate limiting, AWS WAF rate-based rules are the correct service.

  • ✗

    Place the API behind a security group rule that allows only the current client IP range.

    Why it's wrong here

    Security groups are static, stateful network controls for ENIs. They do not inspect HTTP request rates or react to bursts of traffic from a single IP. They also cannot implement edge-based application-layer blocking for a CloudFront-fronted API.

About these practice questions

Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.