AWS Certified Solutions Architect – Associate (SAA-C02) — Question 40

A company's website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer
(ALB). There is also an Amazon CloudFront distribution, and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the
CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website.
What should a solutions architect do to protect the application?

Answer options

• A. Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address.
• B. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.
• C. Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
• D. Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.

Correct answer: B

Explanation

The correct answer is B because AWS WAF is specifically designed to manage web access and can easily block specific IP addresses. The other options either involve modifying network ACLs or security groups, which do not directly interface with the web application layer and thus would not effectively address the issue of blocking the malicious IP from the website.