A company must block one known malicious address from reaching any resource in a VPC. Which control accomplishes that?
Show answer and explanation
Answer: B
Network ACLs support explicit deny entries and are evaluated in order, so a deny for the offending /32 placed above any broader allow rule drops that traffic for the subnets the ACL protects. Rules apply to all resources in those subnets without touching each instance.
Security groups cannot express a deny, which is why the NACL is the correct VPC-wide control.
Why the other options are wrong
- A. Security groups only allow traffic. There is no deny entry to add, and an allow-list redesign would not scale to block a single address quickly.
- C. WAF filters HTTP requests at supported endpoints such as CloudFront or an ALB. It does not protect non-HTTP resources or direct connections in the VPC.
- D. Route tables direct traffic leaving a subnet and cannot drop a single external source address for inbound connections.
Exam tip. Deny at the subnet edge means NACL; security groups cannot deny.