Mitigating DDoS with AWS WAF and Global Accelerator

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Configure an AWS WAF web ACL on the ALB to block traffic by using rate-based rules

Question

A company uses AWS to host its public ecommerce website. The website uses an AWS Global Accelerator accelerator for traffic from the internet. The Global Accelerator accelerator forwards the traffic to an Application Load Balancer (ALB) that is the entry point for an Auto Scaling group. The company recently identified a DDoS attack on the website. The company needs a solution to mitigate future attacks. Which solution will meet these requirements with the LEAST implementation effort?
  1. Configure an AWS WAF web ACL for the Global Accelerator accelerator to block traffic by using rate-based rules
  2. Configure an AWS Lambda function to read the ALB metrics to block attacks by updating a VPC network ACL
  3. Configure an AWS WAF web ACL on the ALB to block traffic by using rate-based rules Correct Answer
  4. Configure an Amazon CloudFront distribution in front of the Global Accelerator accelerator

Key Takeaways

The core trap is assuming Global Accelerator supports Layer 7 filtering; it only supports Layer 4, so WAF must be applied to the ALB instead.

This question addresses the integration of AWS WAF with AWS services to mitigate DDoS attacks, specifically clarifying that AWS WAF cannot be attached directly to Global Accelerator.

Common mistake: Many candidates select Option A because they assume Global Accelerator can natively integrate with AWS WAF for web traffic filtering, which is technically incorrect.

Expert Analysis

Why the Answer Is Correct

Option C is the correct solution because AWS WAF is a Layer 7 (HTTP/HTTPS) service designed to protect web applications like those behind an Application Load Balancer (ALB). While Global Accelerator operates at Layer 4 (TCP/UDP) and does not support AWS WAF integration, the ALB downstream fully supports attaching a Web ACL. Configuring rate-based rules on the ALB effectively mitigates volumetric or application-layer DDoS attacks with minimal implementation effort compared to custom Lambda solutions.

Why the Other Options Are Wrong

Option A is incorrect because AWS Global Accelerator does not support AWS WAF; it terminates at edge locations but passes traffic via Anycast IP without inspecting HTTP headers. Option B involves significant custom development using Lambda and Network ACLs, which violates the 'least implementation effort' requirement and NACLs are stateless Layer 3/4 controls unsuitable for sophisticated web attack mitigation. Option D introduces CloudFront, which adds unnecessary complexity and cost when the existing ALB already provides the necessary hook for WAF.

Community Comment Notes

Community consensus strongly favors Option C based on official AWS documentation stating that Global Accelerator cannot use WAF. As noted by user sOI852POL, "Global Accelerator itself doesn't support AWS WAF." Another commenter, rpmaws, confirmed that "WAF can be applied on ALB, API gateway or cloud front." Some users argued for A, believing GA could block traffic at the edge, but this contradicts the architectural limitation that GA is a transport layer service.

Official Reference

https://repost.aws/knowledge-center/globalaccelerator-aws-waf-filter-layer7-traffic

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always verify the OSI layer capabilities of AWS networking services. If a service is Layer 4 only (like Global Accelerator), it cannot run Layer 7 protections (like WAF); look for the next available Layer 7 entry point in your architecture.

Frequently Asked Questions

Can I attach AWS WAF directly to a Global Accelerator accelerator?

No. Global Accelerator operates at Layer 4 and does not support AWS WAF integration. You must apply WAF to a supported resource like an ALB, API Gateway, or CloudFront distribution.

Why is configuring WAF on the ALB better than using CloudFront?

The question asks for the LEAST implementation effort. Since the ALB is already part of the architecture, adding WAF there requires no new infrastructure deployment, unlike introducing a new CloudFront distribution.

More SAA-C03 FAQ →

Community Votes

C
85%
A
15%

85% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. [Removed] 👍 9 Answered C
    C as AWS WAF cannot be used directly on global accelerator
  2. sOI852POL 👍 5 Answered C
    Answer is C. Note: AWS Global Accelerator itself doesn't support AWS WAF. https://repost.aws/knowledge-center/globalaccelerator-aws-waf-filter-layer7-traffic
  3. rpmaws 👍 5 Answered C
    WAF can be applied on ALB, API gateway or cloud front.
  4. nebajp 👍 4 Answered C
    Correct answer C. Global Accelerator does not work with WAF as it is suitable for TCP/UDP where as WAF is integrates with Application Load Balancer which is on Layer 7 on OSI model, suitable for Web app (Http/Https)
  5. officedepotadmin 👍 2 Answered A
    Global Accelerator can be integrated with AWS WAF to provide protection at the edge, meaning malicious traffic can be blocked before it reaches your Application Load Balancer (ALB) or other resources in your AWS environment.
Show 3 more comments
  1. AWS_Debu 👍 1
    Answer is A AWS Global Accelerator (GA) can be used with AWS Web Application Firewall (WAF) to protect applications from web exploits and DDoS attacks: Block HTTP method and header attacks GA, WAF, and the Application Load Balancer can block access to Layer 7 HTTP method and headers. WAF uses web access control list (web ACL) rules with the load balancer to evaluate incoming traffic and only forward requests that comply with the rules to the endpoint. Detect and mitigate web application layer request floods GA can protect web applications running on Application Load Balancer, and when used with WAF, it can also detect and mitigate web application layer request floods. Prevent DDoS attacks
  2. dhewa 👍 1 Answered A
    Configuring the WAF directly on the Global Accelerator ensures that malicious traffic is blocked before it reaches the Application Load Balancer, providing an additional layer of protection.
  3. komorebi 👍 1 Answered A
    Answer is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide