ANS-C01 Network Security, Compliance and Governance Practice Question
A company needs to block traffic from a specific IP address range in their VPC. Which component should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network ACL
Network ACLs are stateless and can explicitly deny traffic from specific IP address ranges at the subnet level. Option A is wrong because route tables control the path of network traffic, not filtering. Option C is wrong because an internet gateway provides internet connectivity but does not filter traffic. Option D is wrong because security groups are stateful and can only allow traffic, not deny specific IP ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Route table
Why it's wrong here
Route tables define paths, not filtering.
- ✓
Network ACL
Why this is correct
NACLs can deny traffic from specific IP ranges.
- ✗
Internet gateway
Why it's wrong here
Internet gateway does not filter traffic.
- ✗
Security group
Why it's wrong here
Security groups only allow, not deny.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer needs to block traffic from a specific IP address to an EC2 instance. Which component should be modified?
easy- A.Route table
- B.VPC Flow Logs
- ✓ C.Network ACL
- D.Security group
Why C: A Network ACL can deny inbound traffic from a specific IP address at the subnet level. Option A is wrong because route tables do not filter traffic. Option B is wrong because VPC Flow Logs only capture traffic, not filter. Option D is wrong because security groups only support allow rules, not explicit deny.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.