SCS-C02 Question 147
Single answerA company has deployed their application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has identified that some requests to the application are coming from malicious IP addresses. They want to block these IPs without impacting legitimate traffic. What is the MOST efficient way to achieve this?
- A
Use an AWS WAF web ACL and configure a rule to block the malicious IPs.
- B
Modify the security group of the EC2 instances to block the malicious IPs.
- C
Configure an ALB listener rule to deny traffic from the malicious IPs.
- D
Use an Amazon VPC Network Access Control List (NACL) to block the malicious IPs.
Show answer and explanation
Correct answer: A
Explanation
AWS WAF is specifically designed to provide advanced protection for web applications by allowing you to define rules to block or allow traffic based on specific conditions like IP addresses, HTTP headers, or request patterns. In this scenario, using AWS WAF to block the malicious IPs is the most efficient and scalable approach, as it integrates seamlessly with the ALB and allows for easy management of the rules. Other options, such as modifying security groups or using NACLs, are less scalable and harder to maintain.
- A. Correct.
This is the correct answer. AWS WAF (Web Application Firewall) allows you to create web ACLs (Access Control Lists) and rules to block specific IPs or ranges, making it the most efficient and scalable solution for this scenario.
- B. Incorrect.
While security groups can restrict access, they are not well-suited for managing a large or dynamic list of malicious IPs. Security groups are typically used for controlling access at the instance level and do not provide the flexibility or manageability of AWS WAF.
- C. Incorrect.
ALB listener rules do not have the capability to block traffic based on IP addresses. They are used to route traffic based on conditions such as host headers or paths.
- D. Incorrect.
Although NACLs can block IP addresses, they are stateless and can become difficult to manage when dealing with a large number of rules or dynamic IP lists. AWS WAF provides a more streamlined and manageable solution.