SCS-C02 Question 33
Select 2A company is running an application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The company wants to ensure that only requests originating from a specific IP address range can reach the application. Additionally, the security team wants to block requests from a known malicious IP address. How can these requirements be implemented in a secure and scalable way?
- A
Configure a security group on the EC2 instances to allow traffic only from the specific IP address range and deny traffic from the malicious IP address.
- B
Create a Network ACL for the subnet where the EC2 instances are located to allow traffic only from the specific IP address range and deny traffic from the malicious IP address.
- C
Use an AWS WAF web ACL on the ALB to allow traffic only from the specific IP address range and block traffic from the malicious IP address.
- D
Use a custom Lambda function attached to the ALB to inspect traffic and block requests from the malicious IP address.
- E
Implement a Route 53 geolocation routing policy to restrict access to the application based on the geographic location of the IP addresses.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the security requirements, the company needs a combination of a mechanism that supports explicit allow and deny rules and operates at the appropriate levels. Network ACLs can restrict traffic at the subnet level by allowing traffic from a specific IP range and denying traffic from known malicious IPs. Additionally, AWS WAF provides a scalable and application-specific solution to allow or block traffic at the ALB level. Security groups alone cannot achieve the desired result since they do not support explicit deny rules, and other options like Lambda functions or Route 53 geolocation are either inefficient or unsuitable for this scenario.
- A. Incorrect.
Incorrect: Security groups do not support explicit deny rules, making it impossible to block traffic from the malicious IP address.
- B. Correct.
Correct: Network ACLs operate at the subnet level and support both allow and deny rules, making them suitable for this use case to allow traffic from specific IP ranges and block malicious IPs.
- C. Correct.
Correct: AWS WAF can be used on an ALB to implement precise rules for allowing and blocking traffic based on IP addresses, making it scalable and application-specific.
- D. Incorrect.
Incorrect: Using a custom Lambda function for traffic inspection is neither efficient nor a standard solution for this use case. AWS WAF is better suited for such tasks.
- E. Incorrect.
Incorrect: Route 53 geolocation routing is not designed for blocking specific IP addresses or ranges and does not meet the security requirements in this scenario.