AWS WAF Integration with ALB and Auto Scaling

SAA-C03 By islever Editorial Last updated

Design highly available and/or fault-tolerant architectures.

Short answer

A Create an Auto Scaling group across two AZs, configure an ALB as the target, and connect WAF to the ALB.

Question

A company wants to migrate an application to AWS. The company wants to increase the application's current availability. The company wants to use AWS WAF in the application's architecture. Which solution will meet these requirements?
  1. Create an Auto Scaling group that contains multiple Amazon EC2 instances that host the application across two Availability Zones. Configure an Application Load Balancer (ALB) and set the Auto Scaling group as the target. Connect a WAF to the ALB. Correct Answer
  2. Create a cluster placement group that contains multiple Amazon EC2 instances that hosts the application. Configure an Application Load Balancer and set the EC2 instances as the targets. Connect a WAF to the placement group.
  3. Create two Amazon EC2 instances that host the application across two Availability Zones. Configure the EC2 instances as the targets of an Application Load Balancer (ALB). Connect a WAF to the ALB.
  4. Create an Auto Scaling group that contains multiple Amazon EC2 instances that host the application across two Availability Zones. Configure an Application Load Balancer (ALB) and set the Auto Scaling group as the target. Connect a WAF to the Auto Scaling group.

Key Takeaways

The core trap is attempting to attach AWS WAF directly to an Auto Scaling Group or EC2 instances; WAF must be associated with the ALB to effectively filter incoming web traffic before it reaches the backend resources.

This question tests designing a highly available architecture using AWS WAF, Application Load Balancer (ALB), and Auto Scaling Groups. The correct solution ensures availability across multiple Availability Zones while correctly attaching WAF to the ALB for traffic filtering.

Common mistake: Option D is the most common mistake because it attempts to connect WAF directly to the Auto Scaling Group. This is technically invalid as WAF does not support direct association with ASGs, leading to architectural failure.

Expert Analysis

Why the Answer Is Correct

Option A is the only valid solution that meets both availability and security requirements. By placing EC2 instances in an Auto Scaling Group across two Availability Zones, the application achieves high availability and fault tolerance. Connecting the Auto Scaling Group to an Application Load Balancer (ALB) distributes traffic evenly, and associating AWS WAF with the ALB ensures that malicious requests are filtered at the edge before reaching the compute layer.

Why the Other Options Are Wrong

Option B is incorrect because placement groups are designed for low-latency network performance, not availability, and WAF cannot be attached to a placement group. Option C lacks scalability and elasticity because it uses fixed EC2 instances without an Auto Scaling Group, failing to dynamically handle load changes. Option D is invalid because AWS WAF cannot be directly connected to an Auto Scaling Group; it must be attached to a supported resource like an ALB, API Gateway, or CloudFront distribution.

Community Comment Notes

Community consensus strongly supports Option A, with multiple users noting that WAF must manage incoming traffic at the ALB level. As one commenter noted, "WAF manage incoming traffic should be at ALB, because auto scaling group is behind ALB then it defeats purpose of WAF." Another user clarified that "Not D because AWS WAF cannot be directly connected to an Auto Scaling Group," reinforcing the technical limitation of direct ASG attachment.

Exam Strategy

When designing secure architectures, always place security controls like WAF at the entry point of the application, typically the Load Balancer. Ensure you distinguish between availability features (Multi-AZ, Auto Scaling) and network performance features (Placement Groups) to select the right combination for the requirement.

Frequently Asked Questions

Can AWS WAF be attached directly to an Auto Scaling Group?

No, AWS WAF cannot be directly associated with an Auto Scaling Group. It must be attached to a supported resource like an ALB, API Gateway, or CloudFront distribution.

Why is a Placement Group not suitable for this availability scenario?

Placement Groups are designed for low-latency, high-throughput networking between instances, not for high availability or fault tolerance across Availability Zones.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. trinh_le 👍 6 Answered A
    Not D because AWS WAF cannot be directly connected to an Auto Scaling Group, it should be associated with the ALB which managing the incoming web traffic
  2. Scheldon 👍 5 Answered A
    AnswerA WAF > ALB > AutoScalingGroup(MultiAZ EC2 Instances) Looks good
  3. muhammadahmer36 👍 2 Answered A
    A. Create an Auto Scaling group that contains multiple Amazon EC2 instances that host the application across two Availability Zones. Configure an Application Load Balancer (ALB) and set the Auto Scaling group as the target. Connect a WAF to the ALB.
  4. mk168898 👍 2
    WAF manage incoming traffic should be at ALB, because auto scaling group is behind ALB then it defeats purpose of WAF
  5. sandordini 👍 3
    A: EC2 - MultiAZ > ALB > WAF

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide