A company hosts a public website from an S3 bucket in us‑east‑1 and serves it via an Amazon CloudFront distribution. The company wants protection from DDoS and needs fine control over the rate threshold that triggers mitigation. Which deployment meets that need?

The correct option deploys AWS WAF with a rate-based rule at the CloudFront distribution, which is the appropriate integration point for protecting a public website served via CloudFront. AWS WAF rate-based rules allow you to specify a threshold for requests from a single IP address within a five-minute period, providing fine-grained control for DDoS mitigation. Setting the default action to "allow" ensures legitimate traffic passes, while the rate-based rule specifically blocks excessive requests. Incorrect options are flawed because: Associating WAF with an S3 bucket directly is not supported for S3 static website hosting. WAF must be integrated with CloudFront or an Application Load Balancer. Setting the default action to "block" would block all traffic by default, requiring the rate-based rule to allow legitimate requests, which is an inverted and less secure approach for a public website.