SAP-C02 AWS Shield Advanced Practice Question
A financial services company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed across multiple Availability Zones. The company recently experienced a DDoS attack that overwhelmed the ALB and caused downtime. The security team wants to implement a solution that can absorb DDoS attacks at the edge and only forward legitimate traffic to the ALB. Additionally, the company needs to protect sensitive data in transit using TLS 1.3. What should the solutions architect do?
⚠ Common exam trap
The trap is assuming that any AWS WAF or firewall solution at the ALB level can absorb DDoS attacks, but edge protection (CloudFront + Shield Advanced) is required for absorbing attacks before they reach the ALB.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Amazon CloudFront in front of the ALB with AWS Shield Advanced and enforce TLS 1.3.
Deploying CloudFront in front of the ALB with AWS Shield Advanced provides edge-based DDoS protection, absorbing attacks before they reach the ALB. CloudFront supports TLS 1.3, meeting the encryption requirement. Option B is incorrect because AWS WAF with rate-based rules can help filter malicious traffic but does not absorb DDoS attacks at the edge; it works at the ALB level. Option C is incorrect because AWS Network Firewall is a stateful firewall that protects VPCs, not at the edge, and cannot absorb large DDoS attacks. Option D is incorrect because AWS Shield Standard provides basic protection, but it is not sufficient for absorbing DDoS attacks, and security groups do not mitigate DDoS at the edge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy Amazon CloudFront in front of the ALB with AWS Shield Advanced and enforce TLS 1.3.
Why this is correct
Deploying CloudFront with AWS Shield Advanced provides edge DDoS protection and enforces TLS 1.3, making this the correct solution.
- ✗
Use AWS WAF with rate-based rules and associate it with the ALB.
Why it's wrong here
AWS WAF with rate-based rules can filter web requests but does not absorb DDoS attacks at the edge; it operates at the ALB level, which is behind the edge.
- ✗
Use an AWS Network Firewall and configure stateful rules to block malicious IPs.
Why it's wrong here
AWS Network Firewall is a managed stateful firewall for VPCs, not for edge DDoS absorption; it is not designed to handle large-scale DDoS attacks.
- ✗
Enable AWS Shield Standard and use security groups to restrict traffic.
Why it's wrong here
AWS Shield Standard is free but provides limited protection and does not absorb DDoS attacks effectively; security groups control traffic at the instance level, not at the edge.
Visual reference
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.