Question

A cloud security engineer must block a specific malicious external IP address from reaching any resource within a VPC subnet that hosts multiple EC2 instances. Because security groups only support allow rules and cannot explicitly deny traffic from a single IP, the engineer needs a stateless filtering mechanism applied at the subnet boundary. Which control should be configured to accomplish this?

Accepted Answer

Add a network ACL rule on the subnet that denies inbound traffic from the malicious IP with a lower rule number than any allow rules

Answer

Create an inbound security group rule that denies traffic from the malicious IP on all instances

Answer

Add a route table entry directing the malicious IP's traffic to a blackhole target

Answer

Enable a web application firewall managed rule to drop the malicious IP at the load balancer