nerdexam
Amazon

SCS-C02 · Question #93

A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The…

The correct answer is A. Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests. An AWS WAF IP set match rule directly matches a CIDR range and blocks all requests from those addresses, which is the correct tool for blocking known malicious IP ranges.

Submitted by rohit_dlh· Mar 6, 2026Infrastructure Security

Question

A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet. A security engineer needs to deny access from the offending IP addresses. Which solution will meet these requirements?

Options

  • AModify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests
  • BAdd a rule to all security groups to deny the incoming requests from the IP address range.
  • CModify the AWS WAF web ACL with a rate-based rule statement to deny the incoming requests
  • DConfigure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the

How the community answered

(41 responses)
  • A
    80% (33)
  • B
    12% (5)
  • C
    2% (1)
  • D
    5% (2)

Why each option

An AWS WAF IP set match rule directly matches a CIDR range and blocks all requests from those addresses, which is the correct tool for blocking known malicious IP ranges.

AModify the AWS WAF web ACL with an IP set match rule statement to deny incoming requestsCorrect

An IP set match rule in the WAF web ACL allows you to specify exact CIDR ranges and set the action to Block, directly preventing all requests from the port-scanning IP range with no additional conditions required.

BAdd a rule to all security groups to deny the incoming requests from the IP address range.

Modifying security groups across all instances is operationally intensive, error-prone, and does not scale when multiple IP ranges or future attacks are involved.

CModify the AWS WAF web ACL with a rate-based rule statement to deny the incoming requests

A rate-based rule blocks IPs that exceed a request rate threshold, not specific IP ranges; it would not block slow port scans that stay below the rate limit.

DConfigure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the

Regex match conditions evaluate patterns within request content such as URIs or headers, not source IP addresses, making this the wrong rule type for IP-based blocking.

Concept tested: AWS WAF IP set match rule for IP range blocking

Source: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html

Topics

#AWS WAF#IP set rule#web ACL#port scan blocking

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SCS-C02 Practice