A global ticket retailer faces bot-driven credential stuffing from specific countries during on-sales, with attackers rotating IPs and JA3 fingerprints to evade simple blocks. The app runs behind CloudFront and must allow legitimate fans worldwide while throttling bots. Which edge control design should the architect implement to enforce geolocation and fingerprint-aware throttling?

AWS WAF associated with CloudFront evaluates geography, rate, and client attributes at the edge before origin load, where geo-match statements can allow or challenge specific countries, rate-based rules aggregate by IP or forwarded IP to throttle bursts, and Bot Control managed rules inspect JA3 TLS fingerprints and behavioral signals to detect rotating clients that simple IP limits miss. Route 53 geolocation routing controls DNS answers for performance and localization but provides no request filtering, rate limiting, or fingerprint inspection and cannot block HTTP floods. Shield Advanced protects against DDoS volumetric absorption and adds detection but does not provide WAF content rules, geo blocking, or bot fingerprint logic, while sticky sessions actually help attackers maintain sessions. Network ACLs operate on VPC subnets with IP and port logic and have no relationship to CloudFront edge locations, TLS fingerprints, or HTTP request rates. For the exam remember WAF on CloudFront versus ALB placement matters for global versus regional scope and Bot Control requires appropriate WAF tier. In practice verify logging to S3 with sampled requests to tune false positives before enforcing block actions on ticket sale traffic.