A login API behind an ALB is under a credential-stuffing attack — thousands of requests from rotating IPs. Which WAF feature mitigates this without blocking legitimate users?
A.Geo-blocking rule
Attackers rotate through residential IPs worldwide — geo-blocking hits real users too.
B.Rate-based rule that temporarily blocks IPs exceeding a request threshold
Correct. Rate limiting per source IP is purpose-built for this pattern.
C.IP set match rule with manual blocklist updates
Manual lists can't keep up with rotating IPs — automation is the point.
D.AWS Shield Standard
Shield Standard absorbs L3/L4 DDoS — credential stuffing is an L7 application attack handled by WAF.
Why this answer
A rate-based rule counts requests per IP over a 5-minute window and blocks IPs above your threshold (e.g., 100 requests) — automatically mitigating bursts while letting normal users through. Pair with a CAPTCHA rule for finer control.
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security