A company wants to block malicious traffic before it reaches any AWS region — filtering at edge locations worldwide. Where should AWS WAF rules be attached?
A.To an Application Load Balancer in the primary region
ALB-WAF filters regionally — traffic already arrived in-region.
B.To the CloudFront distribution — WAF evaluates at edge locations
Edge evaluation = global pre-filtering. Correct.
C.To the Network Load Balancer
NLB is Layer 4 — WAF doesn't attach to it.
D.To the API Gateway in each region
API Gateway WAF works per-region — not global edge filtering.
Why this answer
Attaching WAF to CloudFront evaluates rules at edge PoPs — bad traffic is dropped before entering AWS's backbone or your region. ALB-attached WAF is regional (traffic reaches the region first). NLB doesn't integrate with WAF (L4).
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security