CCSP Cloud Platform and Infrastructure Security Practice Question
A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network ACL (NACL)
NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Network ACL (NACL)
Why this is correct
Network ACLs are stateless, subnet-level filters that evaluate allow and deny rules against source and destination IP addresses. A deny rule for the malicious IP therefore blocks its traffic before it reaches any instance in the subnet, matching the subnet-level blocking constraint.
- ✗
Transit gateway
Why it's wrong here
A transit gateway is a regional routing hub that interconnects VPCs, VPNs and on-premises networks; it forwards packets and cannot filter by source IP. It is tempting because it sits between subnets and networks, and would be correct when centralising connectivity across many VPCs rather than blocking a malicious address.
- ✗
Security group
Why it's wrong here
Security groups are stateful instance-level filters attached to elastic network interfaces, not subnets, so they cannot block traffic for an entire subnet. They are tempting because they do filter by IP, and would be correct when the requirement is to restrict traffic to specific EC2 instances rather than the whole subnet.
- ✗
VPC peering connection
Why it's wrong here
A VPC peering connection is a private routing link between two VPCs, carrying traffic without any filtering capability, so it cannot block a malicious IP. It is tempting because it is a network-layer construct, and would be correct when privately connecting two VPCs' CIDR ranges rather than enforcing subnet-level deny rules.
Visual reference
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.