CLF-C02 Question 122
Select 2Your company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer. The application must block suspicious traffic patterns and allow only specific IP addresses to access the admin portal. Which combination of AWS security features and services should you use to meet these requirements?
- A
Use security groups to allow only specific IP addresses to access the EC2 instances.
- B
Use an Amazon CloudFront distribution to cache the admin portal and block all IPs except trusted ones.
- C
Use AWS WAF to block suspicious traffic patterns.
- D
Use a Network ACL to block all IPs by default and allow only trusted IPs.
- E
Use AWS IAM policies to restrict access to the admin portal by IP addresses.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirements, you can use security groups to allow specific IP addresses to access the admin portal and AWS WAF to block suspicious traffic patterns. Security groups provide instance-level control for IP ranges, while AWS WAF can filter traffic based on rules, such as blocking malicious patterns. Network ACLs and IAM policies are not the best fit for this scenario, and CloudFront is not intended for this type of access control.
- A. Correct.
Security groups act as virtual firewalls for EC2 instances, allowing you to specify rules to permit specific IP addresses or ranges. This is suitable for restricting access to the admin portal.
- B. Incorrect.
Amazon CloudFront is used for content delivery and caching, but it is not designed specifically for IP-based access control to EC2 instances. It is not the best fit for this scenario.
- C. Correct.
AWS WAF (Web Application Firewall) is designed to filter and monitor HTTP and HTTPS requests, making it an excellent choice to block suspicious traffic patterns.
- D. Incorrect.
Network ACLs operate at the subnet level and provide an additional layer of security. However, they are not as granular as security groups for instance-specific access control and are not ideal for this scenario.
- E. Incorrect.
AWS IAM policies are used to manage permissions for AWS resources and users, but they cannot restrict access to a web application based on IP addresses.