A financial services company hosts a web application on Amazon EC2 instances inside a public subnet of an Amazon VPC. The security team detects a flood of malicious traffic coming from a specific external IP address range: . To protect the application, the team must immediately block all incoming traffic from this specific IP range before it reaches the EC2 instances.
Which AWS network security feature should the company configure to meet this requirement?
- Network Access Control List (Network ACL)Answer
- BSecurity Group
- CAWS Support ticket requesting IP blocking
- DAWS Transit Gateway
Answer
Network Access Control List (Network ACL)
A Network Access Control List (Network ACL) acts as a stateless firewall at the subnet boundary. Because it supports both allow and deny rules, it can be configured to block all inbound traffic from the specified IP address range before the traffic can reach any resources in the subnet.
Step-by-Step Solution
Key Concept
Network ACLs act as stateless firewalls at the subnet level and support explicit allow and deny rules, whereas Security Groups act as stateful firewalls at the instance level and only support allow rules.