ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices that a specific IP address is generating a high number of requests and wants to block it immediately. What is the MOST efficient way to block this IP address?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the IP address to an IP set in AWS WAF and update the rule to block it
AWS WAF allows adding an IP address to an existing IP set and updating the associated rule to block it, which takes effect quickly and is the most efficient method. Option B is wrong because security groups are stateful and cannot explicitly deny inbound traffic; they only allow rules. Option C is wrong because Network ACLs operate at the subnet level and require updating both inbound and outbound rules, which is slower and less granular than WAF IP sets. Option D is wrong because creating a new web ACL and associating it takes more steps than updating an existing rule, making it less immediate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the IP address to an IP set in AWS WAF and update the rule to block it
Why this is correct
This is the most efficient and targeted method.
- ✗
Add a deny rule in the security group attached to the ALB
Why it's wrong here
Security groups do not support deny rules; they only allow traffic.
- ✗
Update the Network ACL associated with the ALB subnets to deny inbound traffic from the IP address
Why it's wrong here
Network ACLs are stateless and require separate inbound/outbound rules; updating them is less efficient.
- ✗
Create a new web ACL in AWS WAF and associate it with the ALB
Why it's wrong here
Creating a new web ACL is more overhead than updating an existing one.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.