Step2Study
AWS Certified Advanced Networking – Specialty (ANS-C01)Network Security, Compliance, and GovernanceMedium

An e-commerce company uses AWS CloudFront to distribute its content globally. To comply with regional data sovereignty laws and protect against common web exploits, the company needs to restrict content access based on the user's geographic location and filter malicious web requests before they reach the origin servers. Which AWS services should be configured together to achieve this?

  1. AAWS Shield Advanced and Amazon GuardDuty
  2. BAWS Firewall Manager and VPC Network ACLs
  3. CAWS WAF and CloudFront Geo-restriction
  4. DAmazon CloudFront Signed URLs and AWS Secrets Manager
Show answer & explanation

Correct answer: C. AWS WAF and CloudFront Geo-restriction

AWS WAF allows filtering of malicious web requests based on custom rules or managed rule sets, protecting web applications. CloudFront Geo-restriction enables blocking or allowing access to content based on the geographic location of the user, directly addressing data sovereignty requirements.

Why the other options are wrong

  • A. AWS Shield Advanced provides DDoS protection, and Amazon GuardDuty is a threat detection service, neither directly addresses geo-restriction or web application filtering.
  • B. AWS Firewall Manager centrally manages firewalls, and VPC Network ACLs operate at the subnet level, neither is designed for geo-restriction at the edge or specific web application layer filtering.
  • D. CloudFront Signed URLs are for controlling access to private content, and AWS Secrets Manager is for managing secrets, neither addresses geo-restriction or general web exploit filtering.

WAF & CloudFront Geo-restriction

AWS WAF provides web application security, while CloudFront Geo-restriction controls content access based on user location.

  • AWS WAF protects web applications from common web exploits.
  • CloudFront Geo-restriction uses the viewer's IP address to determine location.
  • Both services operate at the edge, close to the user, for efficient filtering.

Memory trick: Web Access Filter guards global content with geographic rules.

Practice this question Study as flashcard All questions
Next question

More Network Security, Compliance, and Governance questions