ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS WAF to protect its web application from common exploits. The security team notices that a specific IP address is generating a high volume of requests and should be blocked immediately. Which action should be taken?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the AWS WAF IP set rule to block the IP address
AWS WAF allows creating IP set rules to block specific IP addresses. Therefore, the correct action is to update the IP set rule to include the problematic IP. Option A is correct. Option B is wrong because security groups operate at the network layer and are not integrated with WAF. Option C is wrong because NACLs are stateless and not suitable for application-layer blocking. Option D is wrong because CloudFront geo-restriction blocks based on geographic location, not individual IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Update the AWS WAF IP set rule to block the IP address
Why this is correct
WAF can block specific IPs at the application layer.
- ✗
Add a rule to the security group to deny traffic from that IP
Why it's wrong here
Security groups do not filter at the HTTP level and are not integrated with WAF.
- ✗
Add a network ACL rule to deny traffic from that IP in the subnet
Why it's wrong here
NACLs are not application-aware and would block all traffic from that IP, not just HTTP.
- ✗
Use AWS CloudFront geo-restriction to block the IP
Why it's wrong here
Geo-restriction blocks by country, not individual IP.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS WAF to protect a web application. They want to block requests that originate from known malicious IP addresses. Which WAF rule type should be used?
easy- A.String match condition
- B.Regex match condition
- C.SQL injection match condition
- ✓ D.IP set match condition
Why D: IP set match conditions are used to match the source IP address of a request against a list of IP addresses. Regex, string match, and SQL injection are for other attack types.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.