A public retail site behind an Application Load Balancer is receiving a flood of HTTP requests that look like a scripted scrape. The team wants to block that request pattern. A security group change was proposed. What fits the HTTP pattern better?
Select an answer to reveal the explanation.
Short Explanation
You can use AWS WAF on the load balancer to match and block the scrape pattern while allowing ordinary HTTP traffic. A security group or a NACL deny on port 443 cannot distinguish the scrape from customers, and turning off access logs only hides evidence—it does not stop requests.
Full Explanation
AWS WAF on the Application Load Balancer is the fitting control because it inspects HTTP requests and can block a scripted scrape by matching its pattern, such as a path, header, or rate. A security group rule can allow or deny ports and addresses, but it cannot distinguish a scrape from a customer when both use HTTP on port 443 or match HTTP content. A NACL deny on port 443 would drop legitimate customer requests along with the scrape, potentially causing an outage. Turning off the load balancer’s access logs does not block requests; it only hides evidence of the traffic. Exam caveat: associate the web ACL with this load balancer, or its rules will not inspect this traffic; begin in count mode to see what the rule would match before switching it to block. Practical check: review the web ACL’s sampled requests to confirm the scrape is blocked and ordinary browsing is allowed.