PAS-C01 Operations and Maintenance Practice Question
An SAP administrator notices that the application logs show repeated authentication failures from a specific IP address. The SAP application is hosted on an EC2 instance behind an Application Load Balancer. What AWS service can be used to block traffic from that IP at the network level?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS WAF to create an IP set and block rule, associated with the ALB.
AWS WAF can be associated with an Application Load Balancer to create IP sets and block rules that filter traffic at the network level (Layer 7). Option A is incorrect because CloudFront geo-restriction blocks by country, not by individual IP address. Option C is incorrect because security groups are stateful and, when an ALB is used, the security group sees traffic from the ALB's private IPs, not the original client IP, so it cannot block the specific IP. Option D is incorrect because network ACLs are stateless and applied at the subnet level; while they can block IPs, they are less targeted and more complex than using AWS WAF directly with the ALB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon CloudFront with a geo-restriction to block the IP.
Why it's wrong here
CloudFront geo-restriction blocks by country, not specific IP, and adds unnecessary complexity.
- ✓
Use AWS WAF to create an IP set and block rule, associated with the ALB.
Why this is correct
AWS WAF can inspect source IP and block requests at the ALB level.
- ✗
Update the security group of the EC2 instance to deny traffic from that IP.
Why it's wrong here
Security groups are stateful and apply to the instance, but traffic from ALB appears to come from the ALB's IP, not the original client IP.
- ✗
Add a network ACL rule to the subnet to deny traffic from that IP.
Why it's wrong here
NACLs are stateless and apply at the subnet level, but ALB traffic still originates from the ALB; also WAF is a more direct solution.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.