A solutions architect needs to deny traffic from a specific malicious IP range at the subnet boundary. Security groups only support allow rules. Which control can explicitly DENY the IP range?
A.A security group with a deny rule for the CIDR block
Security groups cannot deny; they only allow.
B.A network ACL (NACL) with a deny rule for the CIDR block
Correct. NACLs support explicit deny rules evaluated in numbered order.
C.An internet gateway route table entry
Route tables control where traffic goes, not whether it is permitted.
D.An Amazon Route 53 routing policy
Route 53 is DNS; it does not filter packet traffic.
Why this answer
Network ACLs are stateless firewall rules applied at the subnet level and support both allow and deny rules. Security groups operate at the instance/ENI level, are stateful, and support only allow rules — so the explicit deny must be done with a NACL.
Correct answer: B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security