Q24 — AWS SAA-C03 Ch.11

Question 24 of 100 | ← Chapter 11

Q724. A company has an application that serves clients that are deployed in more than 20.000 retail storefront locations around the world. The application consists of backend web services that are exposed over HTTPS on port 443. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The retail locations communicate with the web application over the public internet. The company allows each retail location to register the IP address that the retail location has been allocated by its local ISP.The company's security team recommends to increase the security of the application endpoint by restricting access to only the IP addresses registered by the retail locations.What should a solutions architect do to meet these requirements?

• A. Associate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses. ✓
• B. Deploy AWS Firewall Manager to manage the ALConfigure firewall rules to restrict traffic to the ALModify the firewall rules to include the registered IP addresses.
• C. Store the IP addresses in an Amazon DynamoDB table. Configure an AWS Lambda authorization function on the ALB to validate that incoming requests are from the registered IP addresses.
• D. Configure the network ACL on the subnet that contains the public interface of the ALB. Update the ingress rules on the network ACL with entries for each of the registered IP addresses.

Correct Answer: A. Associate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses.

Explanation

To meet the requirement of restricting access to only the IP addresses registered by the retail locations and increase the security of the application endpoint, the most suitable solution is:A. Associate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses.Option A, associating an AWS WAF web ACL with the ALB and using IP rule sets on the ALB to filter traffic, is the recommended solution to restrict access based on registered IP addresses:- AWS WAF web ACL: AWS WAF provides a web application firewall that allows you to control and filter traffic to your applications. By associating a web ACL with the ALB, you can define rules to allow or block traffic based on various conditions.- IP rule sets: Using IP rule sets, you can define rules that match specific IP addresses or IP ranges. This allows you to restrict access to specific IP addresses.By configuring IP rule sets on the ALB and updating the rule with the registered IP addresses, the solution ensures that only requests coming from the registered IP addresses can access the application. This increases the security of the application endpoint.Option B, deploying AWS Firewall Manager to manage the ALB and configuring firewall rules, is not the best choice for this scenario. AWS Firewall Manager is more suited for managing firewall rules across multiple resources and accounts, and it may not provide the granular control required to restrict access based on registered IP addresses.Option C, storing the IP addresses in an Amazon DynamoDB table and using an AWS Lambda authorization function on the ALB, can be a valid approach, but it adds unnecessary complexity. Using IP rule sets on the ALB directly is a simpler and more efficient solution.Option D, configuring the network ACL on the subnet that contains the public interface of the ALB and updating the ingress rules with entries for each registered IP address, is not recommended. Network ACLs are typically used at the subnet level and may not support the level of granularity required to restrict access based on registered IP addresses. Additionally, managing a large number of IP addresses in network ACL rules can be cumbersome and error-prone.Therefore, the solution that best meets the requirements is A: Associate an AWS WAF web ACL with the ALB and use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses. This solution provides the necessary security by restricting access to only the IP addresses registered by the retail locations, ensuring that only authorized traffic can reach the application endpoint.