A developer creates a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The developer reviews the deployment…

Question

Options

• ACreate a security group rule to deny all inbound traffic from the suspicious IP address. Associate
• BImplement Amazon Detective to monitor traffic and to block malicious activity from the internet.
• CImplement AWS Resource Access Manager (AWS RAM) to manage traffic rules and to block
• DAdd the malicious IP address to an IP set in AWS WAF. Create a web ACL. Include an IP set rule

• A
  2% (1)
• C
  5% (2)
• D
  93% (40)

Explanation

When an application is fronted by an Application Load Balancer (ALB) and malicious traffic is detected from a specific IP, the correct way to block the IP is by using AWS WAF (Web Application Firewall). With AWS WAF, you can create an IP Set to include the offending IP address or range. Then create a Web ACL (Access Control List) with a rule set to BLOCK requests from that IP set. Finally, associate the Web ACL with the ALB. Security groups (Option A) cannot deny specific IPs because they are stateful and allow-only Amazon Detective (Option B) is a security analysis and investigation tool; it doesn't block traffic. AWS RAM (Option C) is for resource sharing across accounts, not for blocking IPs. This approach aligns with AWS's Security Pillar of the Well-Architected Framework and is fully managed, with minimal operational effort.

No community discussion yet for this question.