You need to explicitly deny traffic from a specific IP address to your Amazon EC2 instances. Can Security Groups natively handle explicit deny rules?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: No, use Network ACLs or equivalent for explicit deny rules

Security Groups typically support allow rules only. Network ACLs support both allow and deny rules, making them suitable for blocking unwanted IP addresses....

📋Part of AWS Certified Security – Specialty · AWS Certification Practice

Real Exam ScenarioNetwork ACLs

You need to explicitly deny traffic from a specific IP address to your Amazon EC2 instances. Can Security Groups natively handle explicit deny rules?

✓ Correct Answer & ExplanationNetwork ACLs

Correct Answer

No, use Network ACLs or equivalent for explicit deny rules

Why This Answer Is Correct

Security Groups typically support allow rules only. Network ACLs support both allow and deny rules, making them suitable for blocking unwanted IP addresses.

📚 What This Question Tests

This question evaluates your knowledge of Network ACLs — a core concept tested in AWS Certified Security – Specialty. Understanding Network ACLs is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All AWS Certified Security – Specialty Questions →Browse All AWS Exams →

You need to explicitly deny traffic from a specific IP address to your Amazon EC2 instances. Can Security Groups natively handle explicit deny rules?

You need to explicitly deny traffic from a specific IP address to your Amazon EC2 instances. Can Security Groups natively handle explicit deny rules?

📚 What This Question Tests

More Network ACLs Practice Questions