ANS-C01 Network Design Practice Question
A company is deploying an internet-facing application in AWS. The application must only accept traffic from specific IP addresses of business partners. Which AWS service should be used to enforce this restriction?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that Security Groups or Network ACLs are sufficient for application-layer IP filtering, but they operate at lower network layers and cannot inspect HTTP traffic or be applied to services like CloudFront or ALB for IP-based allow lists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF with an IP set rule
AWS WAF with an IP set rule is the correct choice because it operates at the application layer (Layer 7) and can inspect HTTP/HTTPS requests to allow or block traffic based on source IP addresses. This service is specifically designed to filter web traffic to internet-facing applications, making it ideal for enforcing IP-based restrictions from business partners. Network ACLs and Security Groups operate at the network and instance levels, respectively, and cannot provide the granular, application-layer control required for this use case.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network ACLs with inbound allow rules
Why it's wrong here
Network ACLs operate at the subnet level and function as stateless filters, meaning they cannot evaluate application-layer context or specific HTTP request properties. While you would use them to provide a coarse layer of security for an entire subnet by blocking broad CIDR ranges, they lack the granularity required to manage access control lists based on specific application traffic patterns or identity-based requirements.
- ✗
Security Groups with inbound allow rules
Why it's wrong here
Security Groups cannot reference IP sets from external partners.
- ✗
Amazon Route 53 geoproximity routing
Why it's wrong here
Route 53 routing does not filter traffic to the application.
- ✓
AWS WAF with an IP set rule
Why this is correct
AWS WAF can filter traffic based on IP addresses using IP sets.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.