___________________________________________________________________
AWS Cloud Practitioner AWS WAF &
Shield Practice Test 2026–2027 | Web
Security, DDoS Protection Questions &
Detailed Answers
1. Which AWS service is primarily designed to protect web applications from
common application-layer attacks such as SQL injection and cross-site
scripting?
A. AWS Shield
B. AWS WAF
C. Amazon GuardDuty
D. AWS Firewall Manager
Answer: AWS WAF
Rationale: AWS WAF is a web application firewall that evaluates HTTP(S)
requests and can block or allow traffic based on rules addressing threats such as
SQL injection and cross-site scripting.
2. Which AWS service provides managed protection against distributed
denial-of-service (DDoS) attacks?
,A. AWS Shield
B. Amazon Inspector
C. Amazon Macie
D. AWS WAF
Answer: AWS Shield
Rationale: AWS Shield is AWS's managed DDoS protection service. Shield
Standard provides baseline protection automatically, while Shield Advanced
provides enhanced capabilities.
3. Which AWS Shield offering is automatically available to AWS customers at
no additional charge?
A. Shield Advanced
B. Shield Enterprise
C. Shield Standard
D. Shield Premium
Answer: Shield Standard
Rationale: AWS Shield Standard is automatically enabled for AWS customers
and provides protection against common network and transport-layer DDoS
attacks.
4. Which AWS Shield offering provides enhanced DDoS protection for
applications running on supported AWS resources?
A. Shield Standard
B. Shield Advanced
C. Shield Basic
D. Shield Enterprise
Answer: Shield Advanced
Rationale: Shield Advanced provides additional DDoS protection, visibility,
response capabilities, and access to AWS DDoS Response Team support.
, 5. A company wants to block requests containing a specific malicious IP
address. Which AWS WAF rule capability should it use?
A. IP set
B. Regex pattern set
C. Rate-based rule only
D. Geographic match only
Answer: IP set
Rationale: An AWS WAF IP set allows administrators to specify IPv4 or IPv6
addresses and reference those addresses in WAF rules.
6. What is the primary purpose of an AWS WAF web ACL?
A. Encrypt data at rest
B. Control HTTP(S) requests reaching protected resources
C. Monitor CPU utilization
D. Store application logs
Answer: Control HTTP(S) requests reaching protected resources
Rationale: A web access control list, or web ACL, contains rules that determine
whether web requests should be allowed, blocked, counted, or otherwise
handled.
7. Which AWS WAF capability can help mitigate an application-layer HTTP
flood?
A. Rate-based rules
B. S3 versioning
C. IAM policies
D. KMS grants
Answer: Rate-based rules
Rationale: Rate-based rules can identify excessive request rates from sources
and take configured actions such as blocking or challenging requests.
, 8. A company wants AWS WAF to block requests originating from a particular
country. Which rule type should be used?
A. Size constraint rule
B. Geographic match rule
C. SQL injection rule
D. IP set rule
Answer: Geographic match rule
Rationale: Geographic match statements allow AWS WAF to evaluate requests
based on their geographic origin and apply an appropriate action.
9. Which AWS service provides centralized management of AWS WAF rules
across multiple AWS accounts?
A. AWS Organizations
B. AWS Firewall Manager
C. AWS Control Tower
D. Amazon Inspector
Answer: AWS Firewall Manager
Rationale: AWS Firewall Manager centrally manages firewall rules, including
AWS WAF policies, across AWS Organizations accounts.
10.Which AWS WAF feature allows a company to inspect a request for SQL
injection patterns?
A. SQL injection match statement
B. IP set
C. Geographic match statement
D. Rate-based rule
Answer: SQL injection match statement
Rationale: AWS WAF provides a SQL injection match statement designed to
identify request components that contain SQL injection attack patterns.
AWS Cloud Practitioner AWS WAF &
Shield Practice Test 2026–2027 | Web
Security, DDoS Protection Questions &
Detailed Answers
1. Which AWS service is primarily designed to protect web applications from
common application-layer attacks such as SQL injection and cross-site
scripting?
A. AWS Shield
B. AWS WAF
C. Amazon GuardDuty
D. AWS Firewall Manager
Answer: AWS WAF
Rationale: AWS WAF is a web application firewall that evaluates HTTP(S)
requests and can block or allow traffic based on rules addressing threats such as
SQL injection and cross-site scripting.
2. Which AWS service provides managed protection against distributed
denial-of-service (DDoS) attacks?
,A. AWS Shield
B. Amazon Inspector
C. Amazon Macie
D. AWS WAF
Answer: AWS Shield
Rationale: AWS Shield is AWS's managed DDoS protection service. Shield
Standard provides baseline protection automatically, while Shield Advanced
provides enhanced capabilities.
3. Which AWS Shield offering is automatically available to AWS customers at
no additional charge?
A. Shield Advanced
B. Shield Enterprise
C. Shield Standard
D. Shield Premium
Answer: Shield Standard
Rationale: AWS Shield Standard is automatically enabled for AWS customers
and provides protection against common network and transport-layer DDoS
attacks.
4. Which AWS Shield offering provides enhanced DDoS protection for
applications running on supported AWS resources?
A. Shield Standard
B. Shield Advanced
C. Shield Basic
D. Shield Enterprise
Answer: Shield Advanced
Rationale: Shield Advanced provides additional DDoS protection, visibility,
response capabilities, and access to AWS DDoS Response Team support.
, 5. A company wants to block requests containing a specific malicious IP
address. Which AWS WAF rule capability should it use?
A. IP set
B. Regex pattern set
C. Rate-based rule only
D. Geographic match only
Answer: IP set
Rationale: An AWS WAF IP set allows administrators to specify IPv4 or IPv6
addresses and reference those addresses in WAF rules.
6. What is the primary purpose of an AWS WAF web ACL?
A. Encrypt data at rest
B. Control HTTP(S) requests reaching protected resources
C. Monitor CPU utilization
D. Store application logs
Answer: Control HTTP(S) requests reaching protected resources
Rationale: A web access control list, or web ACL, contains rules that determine
whether web requests should be allowed, blocked, counted, or otherwise
handled.
7. Which AWS WAF capability can help mitigate an application-layer HTTP
flood?
A. Rate-based rules
B. S3 versioning
C. IAM policies
D. KMS grants
Answer: Rate-based rules
Rationale: Rate-based rules can identify excessive request rates from sources
and take configured actions such as blocking or challenging requests.
, 8. A company wants AWS WAF to block requests originating from a particular
country. Which rule type should be used?
A. Size constraint rule
B. Geographic match rule
C. SQL injection rule
D. IP set rule
Answer: Geographic match rule
Rationale: Geographic match statements allow AWS WAF to evaluate requests
based on their geographic origin and apply an appropriate action.
9. Which AWS service provides centralized management of AWS WAF rules
across multiple AWS accounts?
A. AWS Organizations
B. AWS Firewall Manager
C. AWS Control Tower
D. Amazon Inspector
Answer: AWS Firewall Manager
Rationale: AWS Firewall Manager centrally manages firewall rules, including
AWS WAF policies, across AWS Organizations accounts.
10.Which AWS WAF feature allows a company to inspect a request for SQL
injection patterns?
A. SQL injection match statement
B. IP set
C. Geographic match statement
D. Rate-based rule
Answer: SQL injection match statement
Rationale: AWS WAF provides a SQL injection match statement designed to
identify request components that contain SQL injection attack patterns.
