SAA-C03 - Design Secure Architectures (30% of the exam) - Section 1.4

Design network segmentation and edge protection using VPC security groups, network ACLs, AWS WAF and AWS Shield.

Compare stateful security groups with stateless network ACLs and explain where each layer sits in the VPC traffic flow. Apply AWS WAF web ACL rules to filter HTTP threats at the application layer, and recognise which AWS Shield tier provides managed DDoS protection without additional configuration.

Security groupsNetwork ACLsAWS WAFAWS Shield

Practice question for this objective

Free sampleDesign Secure Architecturesmedium

A company runs a public web application on EC2 instances behind an internet-facing Application Load Balancer. The security team wants to block requests containing common SQL injection and cross-site scripting patterns before they reach the instances, and to throttle any single source IP that exceeds a request-rate threshold. Which AWS service should be associated with the load balancer to meet these requirements with the least operational effort?

AConfigure a network ACL on the public subnets to inspect HTTP request bodies and deny those that match injection signatures or arrive too frequently.
BTighten the instance security groups so that inbound rules drop any HTTP request that carries SQL keywords or originates from a high-volume client address.
CEnable AWS Shield Standard on the load balancer and rely on its rules to filter injection traffic and rate-limit abusive source addresses.
DAttach AWS WAF to the Application Load Balancer with managed rule groups for common exploits and a rate-based rule keyed on source IP. Correct

AWS WAF provides Layer 7 inspection of HTTP requests with managed rules and rate-based rules when associated with an Application Load Balancer. Blocking injection and scripting payloads requires inspecting the HTTP request itself, which is a Layer 7 function. AWS WAF integrates natively with the ALB, applies AWS managed rule groups for OWASP-style exploits, and enforces rate-based rules per source IP, all without managing servers.

Why A is wrong: Network ACLs filter only on IP, protocol and port at Layer 3 and 4, so they cannot inspect HTTP payloads for injection patterns or apply per-IP request-rate limits.

Why B is wrong: Security groups are stateful Layer 3 and 4 filters on IP, protocol and port, so they cannot parse HTTP content for injection strings or count request rates per client.

Why C is wrong: Shield Standard defends against network and transport layer DDoS floods automatically but does not inspect HTTP payloads or provide configurable application-layer rate-based rules.

Why D is correct: AWS WAF inspects Layer 7 HTTP requests, ships AWS managed rule groups for SQL injection and cross-site scripting, and supports rate-based rules per source IP, all attachable directly to an ALB.

See more SAA-C03 practice questions, answers explained.

Exam traps in Design Secure Architectures

Answers that look right on this material and are not. Each one is a distractor from a different question in the SAA-C03 bank for this domain.

Add an inbound deny rule for 198.51.100.25/32 with a higher rule number than the allow rule for TCP 443.
Why it is wrong: Because evaluation stops at the first match, the broad allow for 443 would match the malicious address first, so a higher-numbered deny is never reached and the block has no effect.
Rely on AWS Shield Standard, which already includes DDoS cost protection and dedicated response-team support at no charge.
Why it is wrong: Shield Standard gives automatic protection against common network and transport layer attacks but does not include cost protection or response-team access, so it misses both stated needs.
Write custom WAF rules with string and regex match statements for each exploit and update them manually as new threats appear.
Why it is wrong: Custom rules can detect specific patterns, but maintaining a full exploit catalogue by hand is exactly the ongoing burden the requirement says to avoid.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.