Which solution will meet these requirements?

A company’s public website is hosted in an Amazon S3 bucket in the us-east-1 Region behind an Amazon CloudFront distribution. The company wants to ensure that the website is protected from DDoS attacks. A SysOps administrator needs to deploy a solution that gives the company the ability to maintain control over the rate limit at which DDoS protections are applied.

Which solution will meet these requirements?
A . Deploy a global-scoped AWS WAF web ACL with an allow default action. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the CloudFront distribution.
B . Deploy an AWS WAF web ACL with an allow default action in us-east-1. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the S3 bucket.
C . Deploy a global-scoped AWS WAF web ACL with a block default action. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the CloudFront distribution.
D . Deploy an AWS WAF web ACL with a block default action in us-east-1. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the S3 bucket.

View Answer

Answer: A

Explanation:

AWS WAF (Web Application Firewall) helps protect your web applications from common web exploits and bots. A rate-based rule allows you to control the rate of requests to your application.

Create a Global-Scoped AWS WAF Web ACL:

Navigate to the AWS WAF console.

Create a new Web ACL and choose "Global" for the scope.

Set the default action to "Allow".

Configure a Rate-Based Rule:

Within the Web ACL, add a new rule and select "Rate-based rule".

Define the rate limit (e.g., 2000 requests per 5 minutes).

Set the action to "Block".

Associate Web ACL with CloudFront Distribution:

After creating the Web ACL and rule, go to your CloudFront distribution settings. In the "General" tab, associate the Web ACL with your CloudFront distribution. Review and Confirm:

Review the configuration and ensure the Web ACL is correctly associated with the CloudFront distribution.

Reference: AWS WAF Rate-Based Rules

Associating AWS WAF with CloudFront