SCS-C03 Infrastructure Security Practice Question
Exhibit
{
"Name": "RateLimitRule",
"Priority": 1,
"Action": { "Block": {} },
"VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "RateLimit" },
"Statement": {
"RateBasedStatement": {
"Limit": 1000,
"AggregateKeyType": "IP"
}
}
}Refer to the exhibit. A security engineer has deployed this AWS WAF rule. If a single IP address sends 1,500 requests in a 5-minute window, what will happen according to this configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The first 1,000 requests will be allowed, and the subsequent 500 requests will be blocked.
AWS WAF rate-based rules track the number of requests from each IP address over a sliding 5-minute window. If the number of requests exceeds the defined limit (1,000 in this case), the action (Block) is triggered. The IP will remain blocked until its request rate falls below the threshold.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All 1,500 requests will be blocked immediately by the WAF.
Why it's wrong here
The first 1,000 requests within the window will be allowed because they have not yet exceeded the threshold. The 'Block' action only applies to subsequent requests that occur once the counter has reached the limit, meaning the initial traffic up to the limit will still reach the application.
- ✓
The first 1,000 requests will be allowed, and the subsequent 500 requests will be blocked.
Why this is correct
Rate-limiting works by counting requests over time. Once the IP hits the 1,000-request limit, the WAF begins blocking further requests from that IP. As the 5-minute window slides and older requests age out, the IP may be unblocked if its total count falls back below 1,000.
- ✗
The IP will be added to a permanent blocklist until manually removed by an administrator.
Why it's wrong here
Rate-based rules are dynamic and temporary. There is no manual intervention required to unblock an IP. Once the request rate from that specific IP address drops below the configured limit within the rolling 5-minute period, the WAF automatically stops blocking traffic from that source.
- ✗
The WAF will allow all traffic but send an alert to CloudWatch when the limit is exceeded.
Why it's wrong here
The 'Action' in the exhibit is explicitly set to 'Block', which means the WAF will actively drop the traffic. If the action were set to 'Count', then the traffic would be allowed and a metric would be recorded, but in this specific configuration, the rule is enforcing a hard limit.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.