A company runs a global ecommerce website that is hosted on AWS. The company uses Amazon CloudFront to serve content to its user base. The company wants to block inbound traffic from a specific set of

Question

Options

• ACreate an AWS WAF web ACL with an IP match condition to deny the countries' IP ranges.
• BCreate an AWS WAF web ACL with a geo match condition to deny the specific countries.
• CUse the geo restriction feature in CloudFront to deny the specific countries.
• DUse geolocation headers in CloudFront to deny the specific countries.

• A
  5% (1)
• B
  9% (2)
• C
  82% (18)
• D
  5% (1)

Explanation

Amazon CloudFront includes a native geo restriction (geoblocking) capability that allows content owners to control access to their distributions based on the geographic location of the viewer. The viewer's country is determined using the IP address from which the request originates. According to the AWS Certified Security - Specialty Official Study Guide and the Amazon CloudFront Developer Guide, geo restriction is specifically designed for scenarios where organizations must comply with regional regulations, licensing requirements, or data sovereignty policies. From a cost perspective, CloudFront geo restriction is the most cost-effective solution because it is configured directly within the CloudFront distribution and does not require AWS WAF. AWS WAF introduces additional costs for web ACLs, rules, and request processing, which is unnecessary when the requirement is limited strictly to blocking or allowing access based on

No community discussion yet for this question.