AWS Certified Solutions Architect – Associate (SAA-C03) — Question 708

A company’s website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution, and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website.

What should a solutions architect do to protect the application?

Answer options

• A. Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address.
• B. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.
• C. Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
• D. Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.

Correct answer: B

Explanation

AWS WAF allows the creation of IP match conditions (or IP sets) to block web requests originating from specific IP addresses at the application edge. Since AWS WAF is already in use for this architecture, updating its configuration is the most appropriate way to block the malicious IP. Security groups do not support explicit deny rules, and CloudFront does not use network ACLs, making the other options incorrect.