SAP-C02 AWS Shield Advanced Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Deploy Amazon CloudFront in front of the ALB with AWS Shield Advanced and enforce TLS 1.3.

  Why this is correct

  CloudFront absorbs volumetric DDoS at edge locations, forwarding only legitimate traffic to the ALB, satisfying the edge-absorption constraint. Shield Advanced adds enhanced mitigation and cost protection. CloudFront supports TLS 1.3 via security policies, meeting the in-transit encryption requirement. ALB alone cannot absorb edge-level attacks.

• ✗

  Use AWS WAF with rate-based rules and associate it with the ALB.

  Why it's wrong here

  AWS WAF rate-based rules throttle request volume per source IP at the ALB, but the ALB still terminates the flood, so attack traffic reaches the origin and TLS 1.3 termination is not provided. It is tempting because WAF filters application-layer exploits, which suits blocking SQL injection or bad bots rather than volumetric absorption at the edge.

• ✗

  Use an AWS Network Firewall and configure stateful rules to block malicious IPs.

  Why it's wrong here

  Network Firewall inspects traffic entering a VPC, sitting behind the ALB rather than at the edge, so it cannot absorb a volumetric flood before it reaches the load balancer, and it does not terminate TLS 1.3 for clients. It is tempting because stateful rules block malicious IPs, which suits east-west or egress filtering inside a VPC.

• ✗

  Enable AWS Shield Standard and use security groups to restrict traffic.

  Why it's wrong here

  Shield Standard is automatically enabled and only mitigates common layer 3/4 attacks; security groups filter instance traffic after the ALB, so they cannot absorb a flood at the edge or terminate TLS 1.3. It is tempting because Shield Standard is free and always on, which suits basic protection when no edge absorption or TLS requirement exists.

Go deeper

Related to this question