SAA-C03 · Question #186
A company hosts an application on Amazon EC2 instances that are part of a target group behind an Application Load Balancer (ALB). The company has attached a security group to the ALB. During a…
The correct answer is B. Create a geographic match rule in AWS WAF. Attach the rule to the ALB. Why Option B is Correct: AWS WAF: Provides a simple way to create geographic match rules to block or allow traffic based on country IP ranges. Least Operational Overhead: Attaching the WAF rule to the ALB ensures centralized control without modifying ACLs or instance firewalls…
Question
A company hosts an application on Amazon EC2 instances that are part of a target group behind an Application Load Balancer (ALB). The company has attached a security group to the ALB. During a recent review of application logs, the company found many unauthorized login attempts from IP addresses that belong to countries outside the company's normal user base. The company wants to allow traffic only from the United States and Australia. Which solution will meet this requirement?
Options
- AEdit the default network ACL to block IP addresses from outside of the allowed countries.
- BCreate a geographic match rule in AWS WAF. Attach the rule to the ALB.
- CConfigure the ALB security group to allow the IP addresses of company employees. Edit the
- DUse a host-based firewall on the EC2 instances to block IP addresses from outside of the allowed
How the community answered
(59 responses)- A17% (10)
- B71% (42)
- C3% (2)
- D8% (5)
Explanation
Why Option B is Correct: AWS WAF: Provides a simple way to create geographic match rules to block or allow traffic based on country IP ranges. Least Operational Overhead: Attaching the WAF rule to the ALB ensures centralized control without modifying ACLs or instance firewalls. Why Other Options Are Not Ideal: Option A: Network ACLs operate at the subnet level and can become complex to manage for dynamic or evolving IP ranges. Option C: Managing IP-based rules in security groups and ACLs lacks scalability and does not provide country-based filtering. Option D: Configuring host-based firewalls increases operational overhead and does not leverage AWS-managed solutions.
Community Discussion
No community discussion yet for this question.