ANS-C01 Question 12
Single answerYour company is hosting a multi-tier web application on AWS, which includes an Application Load Balancer (ALB) in front of the application servers. You need to ensure that traffic from specific IP address ranges is allowed to reach the ALB, while other traffic is denied. You also want to make sure that any future updates to the IP range can be applied dynamically without modifying the ALB itself. How can you achieve this?
- A
Use Security Groups to allow only the specific IP ranges.
- B
Use AWS WAF with an IP set to allow the specific IP ranges.
- C
Use Network ACLs to allow the specific IP ranges.
- D
Use an Auto Scaling Group to dynamically adjust to IP range changes.
Show answer and explanation
Correct answer: B
Explanation
AWS WAF is the correct solution here because it provides an IP set feature that allows for dynamic management of IP ranges. This is particularly useful when IP ranges need to be updated frequently, as it avoids the need to modify the ALB configuration directly. By associating the WAF with the ALB, you can ensure that only traffic from the specified IP ranges is allowed, while other traffic is denied.
- A. Incorrect.
Security Groups can be used to allow or deny specific IP ranges, but they require manual updates for any changes to the IP ranges. They are not dynamic in this scenario.
- B. Correct.
AWS WAF allows you to create an IP set and associate it with the ALB. This enables you to dynamically manage allowed or blocked IP ranges without modifying the ALB itself. This is the correct option.
- C. Incorrect.
Network ACLs can control traffic at the subnet level, but they are not dynamic and do not integrate directly with ALBs for user-specific IP control.
- D. Incorrect.
Auto Scaling Groups manage EC2 instances based on demand, not IP range updates, and are unrelated to traffic filtering requirements.