Which of the below mentioned methods is the best to stop a series of attacks coming from a set of determined IP ranges?

Answer options:

A.Create a custom route table associated with the web tier and block the attacking IP addresses from the IGW (internet Gateway)
B.Create web Security Group rules to block the attacking IP addresses over port 80
C.Put the application on the private subnet.
D.Create an inbound NACL (Network Access control list) associated with the web tier subnet with deny rules to block the attacking IP addresses

Answer – D
A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC
For more information on NACL please visit the below URL:
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html