Examkin

Question

Difficulty: EasyVPC Network Security

A company's security team identifies malicious traffic originating from a single public IP address (198.51.100.45198.51.100.45). A solutions architect must immediately block all incoming traffic from this specific IP address to an entire public subnet. Which of the following actions should the solutions architect take to meet this requirement?

  1. Add an inbound deny rule for the malicious IP address in the Network Access Control List (Network ACL) associated with the public subnet.Answer
  2. B
    Add an inbound deny rule for the malicious IP address in the Security Group associated with the EC2 instances in the public subnet.
  3. C
    Associate a new AWS WAF web ACL with the public subnet and create a rule to block the malicious IP address.
  4. D
    Modify the route table associated with the public subnet to route the malicious IP address to a blackhole target.

Answer

Add an inbound deny rule for the malicious IP address in the Network Access Control List (Network ACL) associated with the public subnet.
The correct answer describes adding an inbound deny rule to the Network ACL associated with the public subnet. Network ACLs operate at the subnet level and are stateless, allowing Solutions Architects to define both allow and deny rules. This allows for blocking a single malicious IP address from reaching any resource inside the subnet.

Step-by-Step Solution

1
Determine the scope of the restriction.
The requirement is to block traffic at the subnet level, rather than individual instances.
This helps determine whether to use an instance-level control (Security Group) or a subnet-level control (Network ACL).
2
Evaluate filtering rules capability.
To block a specific IP address, an explicit deny rule is required. Security Groups only support allow rules, while Network ACLs support both allow and deny rules.
Since the goal is to deny traffic, the solutions architect must use a Network ACL.
3
Apply the configuration.
Add an inbound rule in the Network ACL with a rule number lower than the default allow rule, targeting the IP address 198.51.100.45/32198.51.100.45/32 with a DENY action.
Network ACL rules are evaluated in order of rule numbers, so placing the deny rule first ensures that the traffic is rejected before hitting generic allow rules.

Key Concept

Subnet-level traffic filtering using Network ACLs
Rate this question

Topics

VPC Network Security

More questions from this topic