SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use AWS WAF with rate-based rules

  Why this is correct

  AWS WAF rate-based rules are specifically engineered to mitigate application-layer DDoS attacks by tracking the number of requests from a single client IP within a set time window. When the request count exceeds the configured threshold, AWS WAF blocks subsequent traffic from that IP for the rule's duration, effectively limiting the volume of requests that can reach your origin. This provides an automated, scalable defense that can be attached to Amazon CloudFront, ALB, or API Gateway, and it allows you to fine-tune thresholds based on your normal traffic baseline.

• ✓

  Enable AWS Shield Advanced

  Why this is correct

  AWS Shield Advanced is a managed DDoS protection service that goes beyond the free Standard tier by offering enhanced detection, visibility, and mitigation of large-scale attacks across multiple layers, including network (L3) and transport (L4) protocols. It provides always-on monitoring, automatic mitigation at AWS edge locations, and 24/7 access to the AWS DDoS Response Team, along with cost protection against scaled-up infrastructure during an attack. Shield Advanced also integrates with AWS WAF to give you centralized, coordinated application-layer protection, making it a comprehensive DDoS defense solution.

• ✗

  Apply network ACLs with deny rules

  Why it's wrong here

  Network ACLs (NACLs) are stateless firewall rules applied at the subnet level that allow inbound and outbound traffic filtering, but they are fundamentally ill-suited for DDoS mitigation. Because they are stateless, you must explicitly define return traffic rules, and they cannot dynamically adapt to a changing attack pattern or perform rate-based throttling. NACLs also inspect traffic on a per-packet basis without any capacity to absorb or filter high-volume floods, as the attack traffic will saturate the network pipe before NACL rules can effectively block it.

• ✗

  Use restrictive security groups

  Why it's wrong here

  Security groups act as a stateful, instance-level firewall that can restrict traffic based on source IP, port, and protocol, but they are not designed to mitigate distributed denial-of-service attacks. A DDoS flood typically overwhelms the network infrastructure or application bandwidth before traffic reaches the ENI where the security group is evaluated, so the security group cannot prevent the resource exhaustion. Moreover, security groups lack the ability to perform rate-based monitoring or apply adaptive blocking rules, making them useful for access control but insufficient as standalone DDoS protection.

• ✗

  Enable VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs capture metadata about IP traffic flowing through your VPC, such as source/destination addresses, ports, and packet counts, but they are a passive observability feature rather than an active security control. They do not block, filter, or modify any traffic in real time; they only generate log records after the traffic has already occurred. While flow logs can help you analyze attack patterns post-incident or fine-tune other defenses, they provide zero mitigation capability against an ongoing DDoS attack.

Go deeper

Related to this question