ANS-C01 Network Security, Compliance and Governance Practice Question
A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests from a specific IP address range. Which component should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP set match condition in AWS WAF
AWS WAF includes IP set match conditions that allow you to specify IP addresses to block or allow, which directly addresses the requirement to block requests from a specific IP address range. Option A is wrong because security groups are stateful firewalls for EC2 instances and cannot be directly associated with an ALB to filter web requests. Option C is wrong because AWS Shield Advanced provides DDoS protection but does not offer granular IP-based blocking. Option D is wrong because network ACLs operate at the subnet level and are not integrated with ALB for web request filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security group associated with the ALB
Why it's wrong here
Security groups cannot be associated with ALBs directly; they are applied to ENIs.
- ✓
IP set match condition in AWS WAF
Why this is correct
AWS WAF uses IP sets to match IP addresses and can block them.
- ✗
AWS Shield Advanced
Why it's wrong here
Shield Advanced provides DDoS protection but not granular IP blocking.
- ✗
Network ACL on the ALB's subnets
Why it's wrong here
NACLs are stateless and at the subnet level; ALB does not have a subnet-level control.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.