Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 340 discussion

Goal: Allow access only from specific IP ranges (corporate office), and block everything else. WAF IP set: This is the right tool for matching specific source IP addresses. Default action = Block: Ensures all traffic is blocked unless explicitly allowed. Rule priority 0 (highest priority): Ensures that corporate IPs are evaluated first and allowed. Uses existing web ACL: Minimizes overhead by not needing to create a new ACL.

Agreee with D as prioty 0 is the highest priority rule

Using Existing Web ACL: This approach leverages the existing web ACL, minimizing the need to create a new one, which reduces operational overhead. IP Address Set: By creating a WAF IP address set that matches the corporate office IP address range, you precisely define which IP addresses are allowed access. Blocking by Default: Setting the default action to Block ensures that only traffic from the defined IP addresses is allowed, meeting the security requirement. High Priority Rule: Adding a high-priority rule (priority 0) to allow traffic from the IP address set ensures that legitimate traffic from the corporate office is not blocked.

The requirements are: 1. Restrict access to the CloudFront distribution to users from a known set of IP address ranges (the corporate office). 2. Minimize operational overhead. 3. Use the existing AWS WAF web ACL, which has the default action set to Count. Option D: Create a WAF IP address set that matches the corporate office IP address range. Set the default action on the existing web ACL to Block. Add a rule that has priority 0 that allows traffic from the IP address set.