AWS WAF Deployment Targets: ALB vs Other Services
Which AWS service or resource can a company use to deploy AWS WAF rules?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests knowledge of AWS WAF supported targets (ALB, CloudFront, API Gateway) versus services that do not natively integrate with WAF at the load balancer level.
Identifies Application Load Balancer as a valid AWS WAF integration point for filtering HTTP traffic, distinguishing it from non-compatible services like EC2 or NLB.
Choosing Amazon EC2 (A) by assuming security rules are applied directly to compute instances rather than through integrated network or web layers.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS WAF is designed to filter HTTP and HTTPS traffic, which operates at Layer 7 of the OSI model. Among the provided options, the Application Load Balancer (ALB) is a native target for AWS WAF. You can associate an AWS WAF web ACL directly with an ALB to protect your web applications from common exploits like SQL injection or cross-site scripting. This integration allows WAF to inspect and filter traffic before it reaches the underlying EC2 instances.Why the Other Options Are Wrong
Amazon EC2 (A) is a compute service; while you can install host-based firewalls, EC2 itself is not a direct deployment target for AWS WAF rules in the same way ALB, CloudFront, or API Gateway are. AWS Trusted Advisor (C) is a tool for best practices and cost optimization, not a network security component. Network Load Balancer (D) operates at Layer 4 (TCP/UDP) and does not support AWS WAF because WAF functions at Layer 7 (HTTP/HTTPS).Community Comment Notes
The community consensus strongly supports B, with multiple users noting that WAF integrates with "Application Load Balancer, API Gateway, CloudFront" as per official documentation. One commenter clarified that WAF handles HTTP (Layer 7) while NLB handles TCP (Layer 3/4), reinforcing why D is incorrect. Another user questioned if EC2 could be used, but comments correctly pointed out that ALB is the specific infrastructure component listed here that supports WAF association.Official Reference
Exam Strategy
When asked about AWS WAF deployment, immediately look for Layer 7 services: CloudFront, ALB, API Gateway, and AppSync. If these aren't options, consider that WAF cannot be deployed on Layer 4-only services like NLB or bare EC2 instances without additional proxies.
Frequently Asked Questions
Can I deploy AWS WAF directly on an EC2 instance?
No. AWS WAF is a managed service that must be attached to supported resources like CloudFront, ALB, API Gateway, or AppSync. It cannot be installed directly on EC2.
Why doesn't Network Load Balancer support AWS WAF?
Network Load Balancer operates at Layer 4 (TCP/UDP), whereas AWS WAF functions at Layer 7 (HTTP/HTTPS). WAF needs to inspect HTTP headers and payloads, which NLB does not process.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →