Attach an AWS WAF web ACL with rate based rules to the Application Load Balancer is correct because it can detect and throttle excessive request rates per source IP in a rolling five minute window and block HTTP floods before they exhaust backend resources while allowing legitimate traffic to continue.

The WAF rate based rules provide inline application layer filtering at the ALB and support per IP rate limits and custom rules that match HTTP paths and headers. This keeps the ALB and the EC2 instances available and reduces the need for manual intervention during surges.

Enable VPC Flow Logs, store them in Amazon S3, and analyze them with Amazon Athena to detect and block DDoS patterns is reactive and analytical only because flow logs and Athena queries do not provide inline enforcement at the ALB and they cannot immediately stop a flood of requests.

AWS Shield Advanced provides strong network and transport layer DDoS protection and cost protection but it does not provide the granular HTTP request level filtering or per IP rate limiting on an ALB that is needed to stop application layer floods. The WAF rate based rules are the more precise control for HTTP floods and AWS Shield Advanced can complement WAF in a layered defense.

Build a custom AWS Lambda function to watch for suspicious traffic and update a network ACL during an attack is brittle and coarse because network ACLs operate at the subnet boundary and cannot express HTTP semantics or per path limits and detection plus update latency makes this approach less effective than native WAF controls.

Full AWS Practitioner Certification Question