These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-037
Unauthorized access attempts against a subnet continue from a specific IP address range. You want to deny only the traffic from that range for all instances in the subnet at once. Which configuration is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: C. In the network ACL associated with the subnet, add an inbound rule denying that range with a lower rule number than the existing allow rules
Explanation
Because security groups have no deny rules, you use a network ACL to block a specific source. Network ACLs are evaluated in ascending rule-number order and the first matching rule is applied, so the deny rule must have a lower number than the existing allow rules.
Per-choice explanations
A. Add an inbound rule denying that range to the security group of each instance
Incorrect. Security groups consist only of allow rules, and you cannot write deny rules. They are a whitelist mechanism in which anything not explicitly allowed does not pass.
B. Deny traffic destined for that range in the outbound rules of the security group
Incorrect. Restricting outbound traffic does not stop the inbound attempts that arrive from outside. Security groups also have no deny rules in the first place.
C. In the network ACL associated with the subnet, add an inbound rule denying that range with a lower rule number than the existing allow rules
Correct. Because a network ACL applies at the subnet level, it takes effect for every instance in the subnet at once. The order of rule numbers is the deciding point.
D. Add a blackhole route for that range to the subnet's route table
Incorrect. A route table determines the next hop per destination network and cannot filter by source address. It is also not a mechanism for blocking traffic inside a subnet before it arrives.
Practical Use
Security groups and network ACLs are two layers of traffic control in a VPC, and their scope and evaluation model are fundamentally different. A security group is a stateful firewall applied per ENI (instance) that has only allow rules; it evaluates all rules and lets traffic through if any one matches. Because it is stateful, return traffic for a connection allowed inbound passes regardless of outbound rules. A network ACL, by contrast, is a stateless filter applied per subnet that has both allow and deny rules; it evaluates rules in ascending rule-number order and the first match decides the verdict. This difference determines practical usage. A requirement to "block only a specific source" cannot be expressed with a security group, so you use a Deny rule in a network ACL. At that point, note that the default network ACL contains an allow-all rule at number 100, so unless you give the deny rule a lower number (for example 90) it loses in evaluation order and traffic passes through. Also, because it is stateless, allowing a connection requires rules in both the inbound and outbound directions, and forgetting to allow the ephemeral ports (1024-65535) for return traffic stops communication in one direction. Note that when you want fine-grained control of attacks against a web application by source IP or request content, AWS WAF IP sets and rate-based rules are more suitable than network ACLs. On SAA-C03, wording such as "deny a specific IP range" and "apply to the entire subnet at once" points to a network ACL, while "allow traffic to a specific resource" or "allow access only from the ALB" points to a security group. The stateful / stateless difference, evaluation order by rule number, and the handling of ephemeral ports are repeatedly tested in this area.