A global ticket marketplace behind CloudFront and WAF faces bot scalpers from two sanctioned countries using rotating IPs and spoofed headers that pass simple IP-based rate limits. Which edge control design blocks sanctioned geographies while throttling sophisticated bots?
Select an answer to reveal the explanation.
Short Explanation
You need two layers to stop sanctioned-country traffic and keep rotating scalper bots from slipping through. Fingerprinting helps identify bots by their connection behavior even when their IPs and headers change.
Full Explanation
CloudFront geographic restriction denies requests from sanctioned countries at the edge, while WAF rate-based rules throttle abusive request volumes and JA3 fingerprint-aware managed bot rules help identify and throttle sophisticated automation despite rotating IPs and spoofed headers. Together, these controls address both geographic access and bot behavior without relying on a stable source IP. IP rate limiting and header rules alone fail because rotating addresses weaken IP aggregation and headers are easy to spoof, leaving no durable bot signal. JA3 detection in observe mode can surface bot activity, but it does not actively throttle or block that traffic, so scalpers can continue abusing checkout. Origin-only rate limiting and bot inspection fail because enforcement happens after requests pass through CloudFront, consuming edge and origin capacity and adding latency and cost. An exam caveat is that detection in observe mode is not enforcement: the bot rules must take an active throttling or blocking action to meet the requirement. As a practical check, verify the geographic restriction against the sanctioned countries, review WAF bot labels and sampled requests, and test with rotating-IP traffic to confirm the controls act at the edge without disrupting legitimate buyers.