SCS-C02 Question 330
Single answerAn organization has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group across multiple Availability Zones. The organization wants to ensure that only users from a specific country can access the application. Which solution should you implement to meet this requirement?
- A
Use AWS WAF with a geo-match condition on the ALB to allow traffic only from the desired country.
- B
Configure the ALB security group to allow inbound traffic only from IP ranges associated with the desired country.
- C
Use Amazon CloudFront with a geo-restriction policy to deny traffic from all countries except the desired one.
- D
Implement a custom script on the EC2 instances to filter traffic based on the source IP address.
Show answer and explanation
Correct answer: A
Explanation
The most efficient and recommended solution is to use AWS WAF with a geo-match condition attached to the ALB. AWS WAF allows you to define rules to allow or block traffic based on geographic location, and it integrates seamlessly with ALB. Security groups and custom scripts are not suitable for this requirement, while using CloudFront would add unnecessary complexity to the solution.
- A. Correct.
This is the correct solution. AWS WAF supports geo-match conditions, which can be used to filter requests based on the geographic location of the request origin. By associating AWS WAF with the ALB, you can easily allow or block traffic from specific countries.
- B. Incorrect.
Security groups do not support geographic-based filtering. They can only filter traffic based on IP addresses, ports, and protocols, but not based on the geographic location of users.
- C. Incorrect.
While Amazon CloudFront does support geo-restriction, the scenario does not mention the use of CloudFront as a content delivery layer for the web application. Implementing CloudFront just for geo-restriction would be unnecessary overhead in this case.
- D. Incorrect.
Implementing a custom script on EC2 instances to filter traffic based on IP addresses would be inefficient and difficult to maintain compared to using AWS WAF, which provides a built-in and scalable solution for geo-based filtering.