SOA-C02 Instance-level firewall Practice Question

A SysOps administrator notices that an EC2 instance running a web server is receiving unexpected traffic from an IP address that is known to be malicious. The administrator wants to block this IP address at the instance level. Which solution should be used?

⚠ Common exam trap

The question specifies 'at the instance level,' which disqualifies subnet-level solutions like network ACLs. Candidates often overlook this detail and choose NACLs because they support explicit deny.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Install a third-party firewall on the instance.

A host-based firewall (such as a third-party firewall installed on the instance) can block traffic from a specific IP address at the instance level. Option A is incorrect because network ACLs operate at the subnet level, not the instance level. Option B is incorrect because AWS WAF is designed to filter web requests at the application layer and is typically associated with load balancers or CloudFront, not directly with an individual EC2 instance. Option D is incorrect because security groups do not support deny rules; they only allow traffic, so they cannot be used to block specific IPs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Modify the network ACL to deny traffic from that IP.
Why it's wrong here
Network ACLs are stateless and operate at the subnet boundary, not the instance level. Adding a deny rule for that IP would block all traffic entering or leaving the entire subnet, affecting every instance in that subnet, not just the target EC2 instance. Because the requirement is to block traffic specifically to one instance, a network ACL cannot provide this granularity.
✗
Use AWS WAF to block the IP address.
Why it's wrong here
AWS WAF is a web application firewall designed to protect HTTP(S) services, and it can only be attached to Application Load Balancers, Amazon CloudFront distributions, or API Gateway endpoints. It cannot be associated directly with an EC2 instance and does not inspect traffic at the instance's network interface. Therefore, using WAF would not block the IP at the instance level and is ineffective for this scenario.
✓
Install a third-party firewall on the instance.
Why this is correct
A third-party firewall installed on the instance, such as iptables or a host-based security agent, can filter inbound traffic based on source IP at the operating system level before the application processes it. This is the only option that fulfills the 'instance level' requirement, as it controls traffic directly on that specific EC2 instance regardless of the surrounding subnet or VPC configuration. Security groups cannot explicitly deny, making a host-based firewall the correct solution.
✗
Update the security group to deny traffic from that IP.
Why it's wrong here
Security groups function as a virtual firewall at the instance level but are allow-only rule sets. You can add rules to permit specific traffic, but there is no ability to create an explicit deny rule for a particular source IP address. Removing all allow rules for that IP would block traffic, but that would also disrupt any other allowed traffic from that source and is not a true deny action. Thus, updating the security group cannot satisfy the requirement to deny the IP at the instance level.

Visual reference

Go deeper

SOA-C02 Instance-level firewall Practice Question

Why each option matters

Option-by-option breakdown

Related to this question