DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use AWS WAF with an IP set rule to block the malicious IP addresses.

  Why this is correct

  AWS WAF is the correct layer 7 filtering solution because it natively integrates with Application Load Balancers and provides managed IP sets that can be populated with the malicious source IPs. Through a Web ACL rule referencing the IP set, WAF blocks requests from those addresses before they reach the ALB, without affecting legitimate traffic. IP sets can be updated dynamically via API or Security Automation, making them practical for handling frequently changing attacker IP lists while providing access to AWS-managed rule groups for additional application-layer protection.

• ✗

  Configure network ACLs on the ALB's subnet to block the malicious IPs.

  Why it's wrong here

  Network ACLs are stateless and evaluate traffic at the subnet boundary, meaning a rule that denies inbound traffic from a malicious IP must be paired with a corresponding outbound rule to drop return traffic for that same IP, otherwise response packets are not filtered. Because NACLs apply to every resource in the ALB's subnet, they cannot selectively protect the ALB from non-HTTP traffic destined to other instances in the same subnet, and they offer no application-layer awareness such as inspecting HTTP headers or URI patterns. Managing a dynamic list of malicious IPs in NACL rules also requires carefully ordered rule numbers and manual updates, which is less scalable and operations-friendly than a WAF IP set.

• ✗

  Use AWS Network Firewall to inspect and block traffic at the VPC level.

  Why it's wrong here

  AWS Network Firewall operates at the VPC level to inspect traffic through stateful inspection and deep packet inspection, but it lacks the native integration with AWS WAF's managed rule sets designed specifically for Layer 7 protection of an ALB. While this service is the correct choice for implementing fine-grained egress filtering or inspecting non-HTTP protocols across a subnet, it does not provide the specific IP reputation list management required to filter malicious web traffic at the application edge.

• ✗

  Configure security groups to deny inbound traffic from the malicious IP addresses.

  Why it's wrong here

  Security groups are stateful and only support allow rules; there is no way to write an explicit deny rule for a specific malicious IP address. To partially block a single IP, you would have to rewrite the inbound allow rules to enumerate every permitted source CIDR while omitting the malicious one, which becomes unmanageable when the list of bad actors changes frequently or when legitimate traffic comes from many diverse sources. Additionally, security groups associated with an ALB protect the ENIs but are not designed for layer 7 traffic inspection, so this approach does not give you the ability to filter based on request attributes like URI, query string, or headers—capabilities that WAF provides natively.

Go deeper

Related to this question