SOA-C02 Security and Compliance Practice Question
A company operates a web application behind an Application Load Balancer (ALB). The SysOps administrator needs to block incoming requests from specific geographic locations (countries X and Y) and also enforce a rate limit of 100 requests per IP address per 5-minute window to mitigate DDoS attacks. The solution must be centrally configured and apply to all requests handled by the ALB. Which AWS service should be used to implement these requirements?
⚠ Common exam trap
Test-takers frequently confuse AWS WAF with CloudFront geo restriction or AWS Shield Advanced, not realizing that only WAF provides both geo-blocking and rate-based rules that can be directly associated with an ALB without requiring CloudFront.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF
AWS WAF is the correct service because it provides both geographic (geo-match) blocking and rate-based rules that can be associated directly with an Application Load Balancer. Geo-match conditions allow you to block requests from specific countries (X and Y), while rate-based rules can limit requests to 100 per 5-minute window per source IP. This solution is centrally configured at the ALB level, applying to all incoming requests without requiring additional infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS WAF
Why this is correct
AWS WAF offers both geo-match conditions to block requests from specific countries and rate-based rules to limit request rates from an IP address. It integrates directly with ALB and provides a single, centrally managed solution.
- ✗
Amazon CloudFront geo restriction
Why it's wrong here
CloudFront geo restriction (whitelist/blacklist) can block requests from specific countries, but it only works when CloudFront is in front of the ALB. Additionally, it does not provide rate limiting. It is not directly applicable to an ALB alone.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced is a managed DDoS protection service that primarily operates at the network and transport layers (Layers 3 and 4). It provides always-on detection, automated mitigation, and access to the DDoS Response Team, but it does not inspect application-layer traffic. Shield Advanced cannot enforce geo-match conditions or rate-based rules based on HTTP attributes like client IP request frequency. Therefore, while it protects the ALB from volumetric attacks, it does not offer the location-based or rate-limiting controls required by the scenario.
- ✗
Security Groups
Why it's wrong here
Security Groups act as a virtual firewall for EC2 instances, controlling traffic at the instance level based on IP addresses and protocols. They cannot inspect application layer details like geographic location or rate of requests.
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 247-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.