SOA-C02 Networking and Content Delivery Practice Question
A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The security team reports that the ALB is receiving a high number of requests with suspicious User-Agent strings. The SysOps team needs to block these requests at the load balancer level without changing the application code. Which action should be taken?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a listener rule on the ALB that checks the User-Agent header and returns a fixed response.
ALB listener rules can evaluate conditions like the User-Agent header and perform actions such as returning a fixed response, which effectively blocks requests. Option A is incorrect because security groups operate at the network layer and cannot inspect HTTP headers; they filter traffic based on IP addresses and ports. Option B is incorrect because target group health checks determine instance health and do not filter incoming requests based on headers. Option D is incorrect because while AWS WAF can inspect headers and block requests, it is a separate service that adds complexity and cost; the question asks for an action at the load balancer level, and ALB rules provide a simpler direct solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the security group of the ALB to deny traffic from User-Agent strings.
Why it's wrong here
Security groups function as a virtual firewall at the network and transport layers, filtering traffic based on source/destination IP addresses, ports, and protocols. They have no awareness of application-layer payloads, so they cannot read the User-Agent header or any other HTTP attribute. Attempting to deny based on User-Agent strings is impossible at the security group level, and this would not block or filter any incoming HTTP requests.
- ✗
Update the target group health check to filter out suspicious User-Agent strings.
Why it's wrong here
Target group health checks periodically send synthetic requests to registered targets to assess their availability and automatically mark them healthy or unhealthy based on expected status codes. These checks operate against a designated path and interval, and they never inspect or filter the actual client traffic headers such as User-Agent. Thus, using health checks to filter suspicious User-Agent strings is outside their purpose and would have no effect on real requests.
- ✓
Add a listener rule on the ALB that checks the User-Agent header and returns a fixed response.
Why this is correct
ALB listener rules can evaluate header conditions such as User-Agent at the application layer. By configuring a rule that matches specific User-Agent patterns and setting the action to 'Return fixed response' with a 403 status, the ALB blocks those requests before they reach target instances. This approach avoids modifying application code and directly uses the ALB's built-in routing capabilities, making it the most efficient and load-balancer-level solution.
- ✗
Deploy AWS WAF and associate it with the ALB.
Why it's wrong here
While AWS WAF can inspect HTTP headers and block requests, it is an additional service that adds cost and complexity. The question asks for an action at the load balancer level, and ALB rules provide a more direct solution.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.