A SysOps administrator receives an alert from Amazon GuardDuty about suspicious network activity on an Amazon FC2 instance. The GuardDuty finding lists a new external IP address as a traffic…

Question

Options

• ACreate a new security group to block traffic to the external IP address.
• BUse VPC flow logs with Amazon Athena to block traffic to the external IP address
• CCreate a network ACL.
• DCreate a new security group to block traffic to the external IP address.

• A
  12% (6)
• B
  4% (2)
• C
  80% (40)
• D
  4% (2)

Explanation

Network ACLs (NACLs) are the correct tool here because they support explicit DENY rules, which is exactly what's needed to block traffic to a specific IP address. Unlike security groups, NACLs are stateless and operate at the subnet level, allowing you to add an outbound DENY rule targeting the suspicious external IP.

Options A and D are identical (likely a transcription error in this question - one was probably meant to reference modifying an existing security group). Either way, security groups only support ALLOW rules - they have no mechanism for explicit denies. You can restrict what's allowed, but you cannot write a rule that says "deny traffic to 1.2.3.4."

Option B is wrong because VPC Flow Logs + Athena is a monitoring and analysis solution, not an enforcement one. It lets you query traffic patterns after the fact but cannot actively block any connections.

Memory tip: Think of the acronym - ACL = Access Control List = can both Allow and Control (deny). Security groups are a "whitelist only" tool, while NACLs are a full "firewall" that can explicitly block. Whenever an exam question asks you to block or deny a specific IP, reach for Network ACLs.

No community discussion yet for this question.