A global education company runs a web app on ECS in an Auto Scaling group behind an ALB. Weekly, the authentication service is overwhelmed by a surge of failed login attempts coming from about 500 IP addresses that change every week. A solutions architect must prevent these failed login attempts from overloading the authentication service with the most operational efficiency. Which solution meets this requirement?

The correct solution is to create an AWS WAF web ACL with a rate-based rule and associate it with the ALB. This approach is operationally efficient because it automatically identifies and blocks IP addresses exceeding a defined request rate, without requiring manual updates to IP lists. Since the offending IP addresses change weekly, a rate-based rule dynamically adapts to the threat. Using AWS Firewall Manager to create a security group and policy to deny traffic from specific IP addresses is inefficient because the IP addresses change weekly, requiring constant manual updates. Similarly, creating an AWS WAF web ACL with an IP set match rule to block specific IP addresses would also require frequent manual updates, making it operationally inefficient. Allowing access only from specific CIDR ranges is too restrictive for a global web application and would block legitimate users.