Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select 2 answers.
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Concentrate on the misread & misdirect. Must prevent attacks + ensure BC with minimal service interruptions during an ongoing attack. A. Protects against CF bypass attacks, or direc to ALB if attacker can scrape the ALB name. Custom headers. B. BC = yes but this also costs more and widens the attack surface. Are you really going to ask the attacker - attack region A but leave region B alone please? Nope. C. DAX is expensive - no justification. Nope. D. Nope. E. This covers BC > ECS cluster never sees bad traffic = cannot overwhelm with bad requests. This is the misdirect - when the question states ensure bc - you are automtically thinking I need to select specific option so go for B, B is HA not security mitigation. Pay attention to the words then how AWS describes the tech. When all else fails default to AWS design patterns - even if other options sound better CF + WAF is well known DP. AE
Put CloudFront + WAF in front of the ALB to filter attacks at the edge and prevent ALB bypass with a custom header (A, E). This combo is most cost‑effective: uses managed, pay‑as‑you‑go security at the edge rather than expensive multi‑Region or unnecessary caching layers that don’t stop attacks.
broken question B has business continuity E must be chosen A has no business continuity, just recovery or mitigation