Q100 — AWS SAA-C03 Ch.10

Question 100 of 100 | ← Chapter 10

Q700. A company's website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website. What should a solutions architect do to protect the application?Note: AWS certification is more difficult for non-technical personnel, each question needs to spend several minutes to read, reading consumes a lot of time and energy, thus affecting their work, if non-technical personnel have a need for exam shortcuts contact wechat: ANYPASS, we will help you to easily pass (and of course if the technical staff need to contact.

• A. Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address
• B. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address ✓
• C. Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address
• D. Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address

Correct Answer: B. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address

Explanation

To protect the application from an external malicious IP address, a solutions architect should take the following action:B. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address. Option B is the correct solution because AWS WAF is already being used to protect against SQL injection attacks. By modifying the configuration of AWS WAF, an IP match condition can be added to block the specific malicious IP address. AWS WAF allows you to define rules and conditions to filter and block traffic based on various criteria, including IP addresses.Option A, modifying the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address, is not the recommended solution. Network ACLs are typically used for controlling traffic at the subnet level and are not the appropriate tool for blocking specific IP addresses in this scenario.Option C, modifying the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address, is also not the recommended solution. Network ACLs operate at the subnet level and do not provide granular control over traffic to individual instances within a subnet.Option D, modifying the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address, is a possible solution, but it is not the best choice in this scenario. Security groups control inbound and outbound traffic at the instance level, but modifying the security groups would require knowledge of the specific IP address ranges used by the malicious party. Additionally, using AWS WAF provides a more centralized and manageable approach for web application firewall rules.Therefore, the best solution to protect the application from the external malicious IP address is B: Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address. This allows you to leverage the existing AWS WAF configuration and rules to block the specific IP address at the application layer.