SCS-C02 Threat Detection and Incident Response Practice Question
Which TWO AWS services can be used to automatically block malicious IP addresses at the network perimeter? (Select TWO.)
⚠ Common exam trap
Candidates often confuse Security Groups with Network ACLs, thinking Security Groups can block traffic at the network perimeter, but Security Groups are instance-level and cannot block traffic before it enters the subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network ACLs
Network ACLs (NACLs) are stateless virtual firewalls that operate at the subnet level in a VPC. They can be configured with inbound and outbound rules to explicitly deny traffic from specific IP addresses, effectively blocking malicious IPs at the network perimeter before they reach the instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Route 53
Why it's wrong here
Amazon Route 53 is a managed DNS and domain registration service that resolves names to IP addresses and supports routing policies, health checks, and DNSSEC, but it does not sit in the data path for application traffic. It cannot inspect source IPs or drop network packets, so it has no mechanism to automatically block an attacker's address. Therefore Route 53 is not one of the two services that can block specific IPs.
- ✗
Security Groups
Why it's wrong here
Security Groups act as a stateful, instance-level firewall in AWS but implement an allow-only rule model; you cannot add a rule that explicitly denies a particular source IP while allowing others. If a broad allow rule exists (for example, 0.0.0.0/0 for port 443), you cannot override it with a deny for a malicious /32 address because Security Groups do not support deny statements. This makes them unsuitable for automatically blocking specific IPs.
- ✓
Network ACLs
Why this is correct
Network ACLs (NACLs) are stateless, subnet-level firewalls that evaluate rules in ascending numeric order and support both allow and deny rules. To automatically block a specific IP, you can add a deny rule with a /32 source CIDR at the top of the NACL, but because NACLs are stateless you must also write a corresponding rule for the return traffic. This explicit-denying capability makes NACLs one of the correct answers.
- ✓
AWS WAF
Why this is correct
AWS WAF is a web application firewall that inspects HTTP(S) requests at layer 7 and can block an attacker's IP using an IP set match condition attached to a web ACL rule with a Block action. You can also use rate-based rules to automatically block IPs whose request rate exceeds a threshold, which is more flexible than static IP blocking. WAF can be associated with CloudFront, ALB, API Gateway, or App Runner, making it the second correct service.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced is a managed DDoS protection service that detects and mitigates volumetric, state-exhaustion, and L7 attacks at the AWS edge using heuristics and always-on monitoring. It does not expose a feature to manually blacklist a specific source IP; its automated mitigations are driven by traffic anomaly telemetry rather than user-defined IP block lists. Because it cannot be configured to automatically block a listed attacker IP, it is incorrect for this question.
Visual reference
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.