ANS-C01 Network Security, Compliance and Governance Practice Question
A company hosts a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The security team wants to block a list of known malicious IP addresses from accessing the application. They have already created an AWS WAF web ACL and associated it with the ALB. What is the MOST efficient way to block the IP addresses?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an AWS WAF rule to the web ACL that uses the 'IP reputation lists' managed rule group to block malicious IPs.
AWS WAF's managed rule group 'IP reputation lists' automatically blocks known malicious IPs from threat intelligence feeds, providing efficient protection without manual updates. Option A is wrong: CloudFront geo-restriction blocks traffic by geographic location, not specific IP addresses, and adds unnecessary complexity. Option C is wrong: Network ACLs are stateless and operate at the subnet level, not the application layer; managing a large IP list in NACL rules is not scalable. Option D is wrong: Security groups are stateful but are not designed for large IP blocklists, and ALB does not use security group rules for incoming traffic at the application layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place a CloudFront distribution in front of the ALB and use CloudFront's geo-restriction feature.
Why it's wrong here
CloudFront geo-restriction blocks based on geographic location, not individual IP addresses, and would require additional setup and cost.
- ✓
Add an AWS WAF rule to the web ACL that uses the 'IP reputation lists' managed rule group to block malicious IPs.
Why this is correct
Correct: Managed rule group automatically blocks known malicious IPs.
- ✗
Configure a network ACL on the ALB's subnet to deny inbound traffic from each malicious IP.
Why it's wrong here
Wrong: NACLs are stateless and not suitable for application-layer blocking.
- ✗
Add each IP address as an inbound deny rule in the security group of the ALB.
Why it's wrong here
Security groups are stateful and not designed for large-scale IP blocking; adding many rules becomes unmanageable and may hit limits.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.