PAS-C01 Technology Practice Question
A company uses SAP BusinessObjects (BO) on AWS. The BO servers run on EC2 instances in a private subnet. Users access the BI Launch Pad through an Application Load Balancer (ALB) in a public subnet. The company recently received a security audit finding that the ALB is accessible from the internet on port 443, but the security group allows inbound traffic from 0.0.0.0/0. The audit requires that only the company's corporate IP range (203.0.113.0/24) should be allowed. Additionally, the company wants to reduce the attack surface by blocking traffic from other IPs. What should the company do to meet the security requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the security group attached to the ALB to allow only inbound traffic from 203.0.113.0/24 on port 443.
The correct answer because modifying the security group attached to the ALB to restrict inbound traffic on port 443 to only the corporate IP range (203.0.113.0/24) is the most direct and effective way to meet the requirement. Security groups are stateful and can enforce IP-based restrictions. Option A is not the best choice because AWS WAF is not necessary for simple IP allowlisting; it's more suited for complex rules like rate limiting or SQL injection prevention. Option C is incorrect because while a network ACL can also restrict traffic, it is stateless and requires separate inbound and outbound rules, and it applies to the subnet rather than the ALB directly, which is less granular. Option D is unnecessary because moving the ALB to a private subnet would block all internet traffic, preventing even corporate users from accessing BI Launch Pad without additional VPN setup, which is more complex than needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy AWS WAF on the ALB and create a rule to allow only the corporate IP range.
Why it's wrong here
WAF is overkill for simple IP restriction; security groups suffice.
- ✓
Modify the security group attached to the ALB to allow only inbound traffic from 203.0.113.0/24 on port 443.
Why this is correct
Security groups can restrict traffic by source IP.
- ✗
Replace the security group with a network ACL on the ALB subnet to allow only the corporate IP range.
Why it's wrong here
Replacing the security group with a network ACL is incorrect because network ACLs operate at the subnet level and are stateless, whereas security groups control traffic directly to specific resources like the ALB and are stateful. The requirement is to restrict inbound traffic *to the ALB itself*, which is precisely the function of its security group. This option is tempting as NACLs do filter by IP range, providing a coarse-grained, stateless firewall for an entire subnet, suitable for an additional layer of defence or blocking traffic at the subnet boundary.
- ✗
Move the ALB to a private subnet and use a VPN for user access.
Why it's wrong here
Would block all internet access, not just restrict IPs.
Visual reference
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.