CLF-C02 Practice Question 44: Subnet Level Deny
AWS Certified Cloud Practitioner (CLF-C02) · Test 5 · question 4 of 10
Web servers in a public subnet are receiving malicious requests from one specific IP address range. The security team wants to block that range for every instance in the subnet while customers everywhere else can still reach the servers on port 443. What should the team do?
Show answer and explanation
Answer:
A network ACL works at the subnet level and supports both allow and deny rules. Its rules are evaluated in ascending rule-number order until one matches, so a deny rule for the malicious range with a lower number than the rule that allows port 443 blocks that range for every instance in the subnet. Everyone else still reaches the servers. AWS describes this exact use, denying a specific subset of traffic as a subnet guardrail, as where network ACLs are effective.
Option A cannot be done: security groups support allow rules only, so there is no way to write a deny rule in one. Option B would block the attacker, but it would also block every legitimate customer, which the stem rules out. Option D names the right kind of control but the wrong target: AWS WAF protects resources such as Amazon CloudFront distributions, Application Load Balancers and Amazon API Gateway APIs. A web ACL cannot be attached directly to EC2 instances.
Reference: Infrastructure security in Amazon VPC