Question

A gaming company runs in a single AWS Region. Its architecture includes an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group that host a frontend application. The company uses AWS WAF integrated with the ALB. The ALB has one security group associated with it. The company uses AWS Network Firewall with stateful rules. The company has configured Network ACLs. The company needs to automatically block access for game users who violate particular rules. Problematic users must be blocked temporarily for 1 to 2 hours. The company’s software can identify the source IP addresses of problematic users. The company has built a serverless solution to store those IP addresses in Amazon DynamoDB. The company wants to use its existing serverless architecture to automatically block the problematic users. Which solution meets these requirements in the **MOST** scalable way? (Choose two.)

Accepted Answer

A. Create a new AWS WAF IP set that the serverless solution updates. Introduce an AWS WAF deny rule to block traffic from any address in the IP set.; E. Create an AWS Network Firewall stateless rule to drop traffic from the IP addresses of the problematic users. Configure the serverless solution to update the new rule with the IP addresses of the problematic users.

Answer

Configure the serverless solution to modify the network ACLs to block traffic from the IP addresses of the problematic users.

Answer

Configure the serverless solution to modify the ALB security group to block traffic from the IP addresses of the problematic users.

Answer

Create a new AWS WAF IP set that is updated by the serverless solution. Create an AWS WAF rule to redirect traffic from sources that match the IP set to a new API for the serverless solution.