A global streaming service behind CloudFront and ALB faces credential-stuffing bursts from specific countries and rotating IPs, plus scrapers mimicking browsers. The team must block high-risk geographies, throttle login abuse, and challenge suspicious fingerprints without blocking legitimate viewers. Which edge control design meets these layered requirements?
Select an answer to reveal the explanation.
Short Explanation
You need a bouncer who checks ID, counts drinks, and spots fakes. WAF geo plus rate-based rules with Bot Control nails all three at the edge.
Full Explanation
AWS WAF integrated with CloudFront inspects requests at edge locations before origin load, where geo-match statements enforce geography requirements, rate-based rules with scope-down statements on login URIs throttle high-velocity IPs, and Bot Control analyzes client fingerprints like TLS, headers, and behavior to challenge non-human clients without broad blocking. This layered rule group meets distinct threats in one enforcement point with managed updates. Security groups operate at instance and load balancer network layer and cannot evaluate geography or HTTP fingerprints, and Shield Standard provides DDoS protection not bot logic. Network ACLs are stateless subnet filters without HTTP awareness or rate aggregation, and Route 53 georouting directs DNS rather than enforcing security blocks. Shield Advanced improves DDoS response and S3 origin protection but does not provide login rate limiting, and signed URLs control content access authorization rather than detecting credential stuffing or fingerprinting. For the exam, map geography and rate limiting and fingerprinting to WAF capabilities at CloudFront, and in practice test rules in count mode first and scope rate limits narrowly to login paths to avoid viewer impact.