Blocking Malicious IPs with AWS WAF and CloudFront

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

B Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.

Question

A company’s website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution, and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website. What should a solutions architect do to protect the application?
  1. Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address.
  2. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address. Correct Answer
  3. Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
  4. Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.

Key Takeaways

The core concept tested is the granularity of deny rules in AWS security services, specifically that Security Groups only support allow rules while WAF supports explicit denies.

This question tests the correct configuration of AWS WAF to block specific IP addresses at the edge. The correct action is modifying the Web ACL associated with the CloudFront distribution.

Common mistake: Candidates often select Network ACLs or CloudFront settings because they are also entry points, failing to recognize that NACLs operate at the subnet/VPC level and do not inspect HTTP traffic headers like source IP in the same way WAF does for web apps.

Expert Analysis

Why the Answer Is Correct

AWS WAF (Web Application Firewall) is designed to filter web requests based on conditions such as IP addresses, HTTP headers, and body content. By creating an IP match condition in a Web ACL and associating it with the CloudFront distribution, you can explicitly block the malicious IP before it reaches the origin. This is the most effective and appropriate layer for blocking known bad actors targeting a web application.

Why the Other Options Are Wrong

Option A is incorrect because CloudFront distributions do not have Network ACLs; NACLs are associated with subnets in VPCs. Option C is incorrect because Network ACLs are stateless and operate at the subnet level, but more importantly, they are not the primary defense for web applications protected by WAF, and updating them requires knowing the specific subnet IDs. Option D is incorrect because Security Groups are stateful firewalls that only support allow rules; they cannot be used to create deny rules for specific IPs.

Community Comment Notes

Community consensus strongly favors option B. As noted by user 'FlyingHawk', "Security group for EC2 only supports allow rule, not deny rul" which immediately eliminates option D. User 'bujuman' confirmed that the direct blocking feature in the CloudFront console has been deprecated in favor of managing blocks via the Web ACL in WAFv2, reinforcing that B is the current operational standard.

Official Reference

https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always check if a security service supports 'deny' rules. If it's a Security Group, remember it's allow-only. For web application protection involving CloudFront or ALB, AWS WAF is the standard tool for IP-based blocking.

Frequently Asked Questions

Why can't I use Security Groups to block the IP?

Security Groups are stateful virtual firewalls that only support allow rules. You cannot specify a 'deny' rule for a specific IP in a Security Group.

Is WAF better than NACLs for this scenario?

Yes. NACLs operate at the subnet level and are less granular for web traffic analysis. WAF inspects HTTP/S requests and is the designated service for protecting web applications from threats like SQL injection and IP abuse.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. mohammadthainat 👍 5 Answered B
    in WAF you can define Web ACL (Web Access Control List) Rule: IP Set: up to 10,000 IP addresses – use multiple Rules for more IPs
  2. bujuman 👍 4 Answered B
    There was option from disttribution Security Tab ==> Request logs for the specified time range where someone could target an IP address and block it - which action won't do more than creating a block rule under the associated Web ACL- but function has vanished, i don't ask me why. So the only feasable option in WEBACLv2 is to go for an Ipset and ad a WebACL ip match block condition. I really liked the option A the first time i experimented it.
  3. Sivaeas 👍 4 Answered B
    The AWS WAF IP set match statement inspects the IP address of a web request against a set of IP addresses and address ranges. Use this to allow or block web requests based on the IP addresses that the requests originate from
  4. xBUGx 👍 3 Answered A
    You only need to block an IP. And Cloudfront is the first layer
  5. FlyingHawk 👍 1 Answered B
    Network ACL is with VPC at subnet level, A and C are incorrect. security group for EC2 only supports allow rule, not deny rul, D is out. B is correct: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html
Show 2 more comments
  1. Salilgen 👍 1 Answered B
    https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/
  2. Andy_09 👍 12
    Option B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide