ANS-C01 Network Security, Compliance and Governance Practice Question
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team needs to block a specific IP address range that has been launching DDoS attacks. The solution must be implemented at the network edge, before traffic reaches the ALB. What should the security team do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an AWS WAF web ACL with an IP set rule that blocks the IP range and attach it to the ALB.
AWS WAF web ACL attached to the ALB can filter traffic based on IP addresses. Option B is correct because WAF is deployed at the edge (ALB or CloudFront) and can block IP sets. Option A is wrong because security groups are stateful but work at the instance level, not at the edge. Option C is wrong because NACLs are applied at the subnet level, but ALB is in a subnet, so traffic reaches the ALB first; NACL is stateless and less suitable for layer 7 filtering. Option D is wrong because CloudFront with WAF is also edge, but the question says 'before traffic reaches the ALB' and ALB is already in place; adding CloudFront changes the architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Update the security group for the ALB to deny traffic from the IP range.
Why it's wrong here
Security groups are stateful and applied to the ALB, but they work at the instance level; ALB security groups can filter, but WAF is better for edge filtering.
- ✓
Create an AWS WAF web ACL with an IP set rule that blocks the IP range and attach it to the ALB.
Why this is correct
WAF at the ALB blocks traffic before it reaches the backend.
- ✗
Add a network ACL rule on the ALB's subnet to deny inbound traffic from the IP range.
Why it's wrong here
NACLs are stateless and apply to the subnet, but ALB is in the subnet; however, NACLs are not as granular as WAF and require separate rules for inbound/outbound.
- ✗
Deploy Amazon CloudFront in front of the ALB and use AWS WAF to block the IP range at CloudFront.
Why it's wrong here
This adds complexity and changes architecture; the question requires edge blocking without changing the existing setup.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.