SCS-C02 Question 180
Single answerAn organization is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from their corporate office's static IP addresses can access the application. How can this requirement be fulfilled?
- A
Configure a security group on the ALB to allow inbound traffic only from the corporate office's IP addresses.
- B
Create a Network ACL for the subnets hosting the ALB and EC2 instances, allowing traffic only from the corporate office's IP addresses.
- C
Use AWS WAF to create a rule that allows traffic only from the corporate office's IP addresses, and associate it with the ALB.
- D
Add an IAM policy to the EC2 instances to restrict access to the corporate office's IP addresses.
Show answer and explanation
Correct answer: C
Explanation
The best solution to restrict web application traffic to specific IP addresses is to use AWS WAF. AWS WAF allows you to create rules based on IP addresses and other criteria, which can be applied to an Application Load Balancer. Security groups and Network ACLs could provide partial solutions but lack the application-layer controls that AWS WAF offers. IAM policies are not designed for network traffic filtering.
- A. Incorrect.
Security groups cannot be applied directly to an ALB; they are associated with EC2 instances or other AWS resources. While security groups can filter traffic, this option is incorrect because it does not address the ALB's need for IP-based filtering at the application layer.
- B. Incorrect.
Network ACLs operate at the subnet level and can restrict IP-based traffic, but they lack the application-layer awareness needed for detailed web access control. This method would apply to all traffic in the subnet, not just the ALB traffic.
- C. Correct.
AWS WAF is specifically designed for web application security and allows you to configure rules, such as IP-based whitelisting or blacklisting. Associating AWS WAF with the ALB ensures that only traffic from the corporate office's IP addresses is allowed.
- D. Incorrect.
IAM policies are used to manage permissions for AWS resources and services but cannot be used to restrict network traffic to specific IP addresses. This option is irrelevant to the scenario.