ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Shield Advanced and AWS WAF to protect its web application. The security team notices that some legitimate traffic is being blocked. They want to allow traffic from a specific set of IP addresses used by their partners. How can they ensure that partner traffic is not blocked by WAF rules?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.
AWS WAF allows you to create an IP set containing the partner IP addresses and then add a rule with a higher priority than the blocking rules to allow traffic from that IP set. This ensures that partner traffic is explicitly allowed even if other rules would block it. Option A is incorrect because Network ACLs operate at the subnet level and are not evaluated by AWS WAF for application-layer traffic; they also do not have a whitelist feature within WAF. Option B is incorrect because removing blocking rules would leave the application vulnerable; Shield Advanced provides DDoS protection but does not replace WAF rule logic. Option C is incorrect because AWS Shield Advanced does not have an IP whitelist feature; it focuses on mitigating DDoS attacks, not on application-layer allowlisting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add the partner IPs to a Network ACL allow rule in the VPC.
Why it's wrong here
NACLs are stateless and work at subnet level, not at application layer; WAF rules still apply.
- ✗
Remove the blocking WAF rules and rely on Shield Advanced only.
Why it's wrong here
Shield Advanced does not replace WAF for application-layer filtering.
- ✗
Add the partner IPs to an AWS Shield Advanced IP whitelist.
Why it's wrong here
Shield Advanced does not support IP whitelisting for WAF.
- ✓
Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.
Why this is correct
This ensures partner traffic is allowed before it reaches blocking rules.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.