CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate Exam Question Walkthrough
Explore a key exam question on AWS services for IP address restrictions and learn how to tackle similar scenarios effectively.
A common pitfall for candidates is understanding the right AWS service for IP address restrictions. Candidates often confuse different services that serve distinct purposes. Knowing the specifics can help you choose correctly.
The question
A company is migrating an on-premises application to AWS and needs to ensure that the application can only be accessed by specified IP addresses for security reasons. Which AWS service should they use to enforce this requirement?
- A. AWS WAF
- B. AWS Shield
- C. Amazon CloudFront
- D. Amazon VPC Network ACLs
Think before you scroll
Before looking at the options, consider the primary function of each service. Focus on services that manage traffic control and security, as the scenario emphasizes restricting access by IP addresses.
The answer
The correct option is D. Amazon VPC Network ACLs. VPC Network ACLs allow control of inbound and outbound traffic to and from subnets in a VPC, making them suitable for restricting access based on specified IP addresses.
Why the other options lose
- A. AWS WAF: AWS WAF (Web Application Firewall) protects web applications by filtering and monitoring HTTP traffic. While it can block requests from specific IP addresses, it is primarily focused on web applications and does not control traffic at the network layer like VPC Network ACLs.
- B. AWS Shield: AWS Shield is a managed DDoS protection service. It does not provide IP address restriction capabilities. Its purpose is to protect applications from DDoS attacks, which is not relevant to controlling access based on IP addresses.
- C. Amazon CloudFront: CloudFront is a content delivery network (CDN) that caches content for faster delivery. While it can restrict access based on geographic locations or signed URLs, it is not designed specifically for IP address restrictions at the network level.
The concept behind it
Understanding how AWS services operate at different layers is crucial. VPC Network ACLs work at the network layer, controlling traffic based on IP addresses. Other services like AWS WAF and CloudFront operate at the application layer, focusing on HTTP/S traffic and content delivery. This distinction is vital for making the right choice in exam scenarios.
Exam trap to remember
Remember: VPC Network ACLs control traffic at the network level while AWS WAF and other services focus on application-layer security. Always match the service to the specific requirements of the question.