AWS WAF Deployment Targets: ALB vs Other Services

CLF-C02 By islever Editorial Last updated

Identify components and resources for security.

Short answer

B An Application Load Balancer is a supported target for deploying AWS WAF rules to filter HTTP/HTTPS traffic.

Question

Which AWS service or resource can a company use to deploy AWS WAF rules?
  1. Amazon EC2
  2. Application Load Balancer Correct Answer
  3. AWS Trusted Advisor
  4. Network Load Balancer

Key Takeaways

Tests knowledge of AWS WAF supported targets (ALB, CloudFront, API Gateway) versus services that do not natively integrate with WAF at the load balancer level.

Identifies Application Load Balancer as a valid AWS WAF integration point for filtering HTTP traffic, distinguishing it from non-compatible services like EC2 or NLB.

Common mistake: Choosing Amazon EC2 (A) by assuming security rules are applied directly to compute instances rather than through integrated network or web layers.

Expert Analysis

Why the Answer Is Correct

AWS WAF is designed to filter HTTP and HTTPS traffic, which operates at Layer 7 of the OSI model. Among the provided options, the Application Load Balancer (ALB) is a native target for AWS WAF. You can associate an AWS WAF web ACL directly with an ALB to protect your web applications from common exploits like SQL injection or cross-site scripting. This integration allows WAF to inspect and filter traffic before it reaches the underlying EC2 instances.

Why the Other Options Are Wrong

Amazon EC2 (A) is a compute service; while you can install host-based firewalls, EC2 itself is not a direct deployment target for AWS WAF rules in the same way ALB, CloudFront, or API Gateway are. AWS Trusted Advisor (C) is a tool for best practices and cost optimization, not a network security component. Network Load Balancer (D) operates at Layer 4 (TCP/UDP) and does not support AWS WAF because WAF functions at Layer 7 (HTTP/HTTPS).

Community Comment Notes

The community consensus strongly supports B, with multiple users noting that WAF integrates with "Application Load Balancer, API Gateway, CloudFront" as per official documentation. One commenter clarified that WAF handles HTTP (Layer 7) while NLB handles TCP (Layer 3/4), reinforcing why D is incorrect. Another user questioned if EC2 could be used, but comments correctly pointed out that ALB is the specific infrastructure component listed here that supports WAF association.

Official Reference

https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-cloudfront-regions.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about AWS WAF deployment, immediately look for Layer 7 services: CloudFront, ALB, API Gateway, and AppSync. If these aren't options, consider that WAF cannot be deployed on Layer 4-only services like NLB or bare EC2 instances without additional proxies.

Frequently Asked Questions

Can I deploy AWS WAF directly on an EC2 instance?

No. AWS WAF is a managed service that must be attached to supported resources like CloudFront, ALB, API Gateway, or AppSync. It cannot be installed directly on EC2.

Why doesn't Network Load Balancer support AWS WAF?

Network Load Balancer operates at Layer 4 (TCP/UDP), whereas AWS WAF functions at Layer 7 (HTTP/HTTPS). WAF needs to inspect HTTP headers and payloads, which NLB does not process.

More CLF-C02 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. CTao 👍 2 Answered B
    Deploy on Application Load Balancer, API Gateway, CloudFront
  2. Supercell 👍 1 Answered B
    According to Google Gemini AI : AWS WAF rules can be deployed through web application firewalls. Of the options provided, only Application Load Balancers integrate with AWS WAF. So the answer is: B. Application Load Balancer
  3. Nikmah 👍 1 Answered B
    AWS WAF – Web Application Firewall • Protects your web applications from common web exploits (Layer 7) • Layer 7 is HTTP (vs Layer 4 is TCP) • Deploy on Application Load Balancer, API Gateway, CloudFront
  4. ShaiTay 👍 1 Answered B
    B. Application Load Balancer- AWS WAF can be deployed to filter HTTP(S) traffic before it reaches your web application.
  5. KhanhNT 👍 1 Answered B
    AWS WAF can be deployed on Amazon CloudFront, the Application Load Balancer (ALB), Amazon API Gateway, and AWS AppSync.
Show 2 more comments
  1. Zerro 👍 1
    Why is it B, can't the rules directly be deployed in EC2, hence the correct answer being A???
  2. 123asdzxcxza 👍 1 Answered B
    WAF is HTTP, level 7; Network load balance is TCP, level 3

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which migration strategies move a cloud-incompatible CMS with least effort?

S-grade

Launching Third-Party IDS in AWS

S-grade

Which AWS Support Plan Offers API Access Most Cost-Effectively?

S-grade

S3 Express One Zone for Single-Digit Millisecond Latency

S-grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide