Two services guard the front door of an AWS web application, and the SAA-C03 rewards you for knowing which door each one guards. AWS WAF works at layer 7 — it reads HTTP requests and blocks the bad ones by your rules. AWS Shield works at layers 3 and 4 — it absorbs volumetric DDoS attacks aimed at saturating your network. Almost every question here turns on matching a described threat to the correct layer, and the diagram traces the single request path where both sit.
Where AWS WAF attaches
A WAF web ACL does not float in front of “the internet”; it attaches to a specific resource — CloudFront, an Application Load Balancer, or API Gateway. If a scenario asks you to inspect and block requests, first confirm the target is one of those three. WAF sees the request’s URI, headers and body, so it can catch SQL injection and cross-site scripting signatures — content a security group or network ACL, which only match on IP, port and protocol, can never see.
The WAF rule types the exam tests
Four rule shapes recur. Managed rule groups (AWS Managed Rules) give AWS-maintained coverage of common exploits with almost no upkeep — the answer whenever the requirement is broad protection with low operational overhead. Rate-based rules count requests per source IP over a trailing window and throttle a noisy client — the answer to an HTTP-request flood, which Shield would wave through as valid traffic. Geo-match conditions block or allow by country, and IP sets match specific CIDR ranges; the two together express allow/deny lists at the request layer.
Shield Standard versus Shield Advanced
Shield Standard is on for every account, free and automatic, mitigating common layer 3/4 attacks — with the deepest coverage at the edge for CloudFront and Route 53. You never “enable” it. Shield Advanced is the paid subscription that adds three things worth remembering: access to the DDoS Response Team, richer attack telemetry, and cost protection — credits for the scaling charges a large attack can drive on services like load balancing and data transfer. When a stem mentions a 24/7 specialist team or protection against attack-driven bills, it is describing Advanced.
Matching the threat to the service
The decisive move is reading the threat, not the service name in the options. An application-layer attack — an exploit string, a request flood, traffic from a barred country — is WAF territory. A volumetric network or transport flood — a SYN flood, a UDP reflection attack saturating bandwidth — is Shield territory. WAF never sees non-HTTP packets, so it cannot touch a UDP flood; Shield never parses HTTP, so it cannot stop a SQL injection. The two are complementary, not interchangeable, and the exam plants an option from the wrong layer in nearly every question. Note this is deliberately not about restricting who can view content behind CloudFront — signed URLs and origin access are a different control, covered in the CloudFront scenarios.
How to use the seven scenarios below
Answer each one before opening the explanation, and when you miss, name the layer the threat lives on — 7 for WAF, 3/4 for Shield — and let that decide. Every explanation takes the wrong-layer distractors apart. For the full domain, see Design Secure Architectures.
Updated for SAA-C03 (July 2026). The sample questions above are our own work
in the style of the exam — not real exam items. The exam itself is set and marked
by the certification body.