AWS Service for Custom Web Traffic Filtering Conditions
A company is hosting a web application on Amazon EC2 instances. The company wants to implement custom conditions to filter and control inbound web traffic. Which AWS service will meet these requirements?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the specific capability of AWS WAF to evaluate HTTP/HTTPS requests based on customizable rules, distinguishing it from network-level or threat-intelligence-based services.
AWS WAF is the correct service for implementing custom conditions to filter and control inbound web traffic on EC2-hosted applications. This page explains how WAF integrates with Application Load Balancers and CloudFront to protect against common web exploits.
Learners often confuse AWS WAF with AWS Shield because both provide web protection. However, Shield is primarily for DDoS mitigation (Layer 3/4), while WAF handles Layer 7 application-level filtering with custom logic.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS WAF (Web Application Firewall) is designed specifically to filter and control web traffic based on customizable security rules. It allows you to define conditions such as IP addresses, HTTP headers, query strings, and body content to allow, block, or count requests. Since the requirement is to implement "custom conditions" for "inbound web traffic," AWS WAF is the precise tool for this job.Why the Other Options Are Wrong
Amazon GuardDuty (A) is a threat detection service that monitors for malicious activity using ML and threat intelligence; it does not actively filter or block traffic via custom rules in real-time. Amazon Macie (C) uses machine learning to discover and protect sensitive data (like PII) in S3 buckets, not for general web traffic filtering. AWS Shield (D) provides DDoS protection, but its standard features are automatic and do not offer the granular, custom rule-based filtering described in the scenario.Community Comment Notes
The community consensus strongly supports AWS WAF. One user noted that "AWS WAF helps you protect against common web exploits and bots," which aligns with the need for traffic control. Another simply confirmed B is correct. The high vote share indicates clear understanding of the distinction between WAF and Shield.Exam Strategy
When you see keywords like 'web traffic', 'HTTP/HTTPS', 'SQL injection', 'cross-site scripting', or 'custom rules', immediately think AWS WAF. If the question mentions 'DDoS' or 'availability' without custom rules, consider AWS Shield instead.
Frequently Asked Questions
Why not use AWS Shield for custom web traffic filtering?
AWS Shield protects against DDoS attacks but does not support creating custom rules to inspect and filter specific web request contents like SQL injections or XSS.
Can AWS WAF work with Amazon EC2 instances directly?
Yes, AWS WAF can be associated with an Application Load Balancer (ALB) that distributes traffic to your EC2 instances, or with CloudFront distributions.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →