A company wants to deploy AWS WAF web ACLs to improve application security for an app behind an Application Load Balancer. The web ACLs must not block legitimate traffic. What is the recommended way for the solutions architect to configure the web ACL rules to avoid impacting valid users?

The correct approach is to initially set WAF rules to "Count" mode. This allows WAF to evaluate traffic against the rules without blocking anything, providing visibility into potential false positives. By enabling WAF logging and analyzing sampled requests, you can identify legitimate traffic that would have been blocked. This data helps refine the rules to accurately target malicious activity while allowing valid users. Once confident in the rule accuracy, the action can be changed to "Block." Using only rate-based rules with a high throttle limit is insufficient for comprehensive security and doesn't address other attack vectors. Setting rules to "Block" immediately, even with AWS-managed rule groups, risks blocking legitimate users from the start, causing service disruption. Using only custom rule groups with "Allow" as the initial action is incorrect because "Allow" bypasses WAF evaluation entirely, offering no insight into what would be blocked.