A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is experiencing a DoS attack. Logs show requests originate from a small set of client IP addresses that rotate frequently. The company needs to block the malicious traffic with minimal ongoing operational effort. Which solution meets these requirements?

Creating an AWS WAF rate-based rule and associating it with the ALB is the most effective solution. AWS WAF can detect and mitigate common web exploits and bot attacks, including DoS attacks. A rate-based rule automatically blocks IP addresses that exceed a defined request threshold within a five-minute period, effectively mitigating attacks from frequently rotating IPs with minimal operational effort. Updating the security group or network ACL to block attacking IP addresses is impractical because the client IPs rotate frequently, requiring constant manual updates. Attaching an AWS WAF rule to the EC2 instance security group is incorrect; AWS WAF operates at the application layer and integrates with ALBs, CloudFront distributions, or API Gateways, not directly with EC2 security groups.