A benefits enrollment company hosts a 3-tier web application running in a VPC on AWS which includes a NAT (Network Address Translation) instance in the public Web tier. There is enough provisioned capacity for the expected workload for the new fiscal year benefit enrollment period plus some extra overhead. Enrollment proceeds nicely for two days, but the web tier becomes unresponsive upon investigation using CloudWatch and other monitoring tools. It is discovered that there is a huge and unanticipated amount of inbound traffic coming from a set of 15 specific IP addresses over port 80 from a country where the benefits company has no customers. The web tier instances are so overloaded that benefit enrollment administrators cannot even SSH into them. Which activity would be useful in defending against this attack?

Answer options:

A.Create a custom route table associated with the web tier and block the attacking IP addresses from the IGW (Internet Gateway).
B.Change the EIP (Elastic IP Address) of the NAT instance in the web tier subnet and update the Main Route Table with the new EIP.
C.Create 15 Security Group rules to block the attacking IP addresses over port 80.
D.Create an inbound NACL (Network Access Control List) associated with the web tier subnet with deny rules to block the attacking IP addresses.

Answer – D
In this scenario, the attack comes from a set of certain IP addresses over a specific port from a specific country. You are supposed to defend against this attack. 
In such questions, always think about two options: Security groups and Network Access Control List (NACL). Security Groups operate at the individual instance level, whereas NACL operates at the subnet level. You should always fortify the NACL first, as it is encounter first during the communication with the instances in the VPC.Option A is incorrect because IP addresses cannot be blocked using the route table or IGW.
Option B is incorrect because changing the NAT instance`s EIP cannot block the incoming traffic from a particular IP address.
Option C is incorrect because (a) you cannot deny port access using security groups, and (b) by default all requests are denied; you open access for a particular IP address or range. You cannot deny access to particular IP addresses using security groups.
Option D is CORRECT because (a) you can add deny rules in NACL and block access to certain IP addresses. See an example below.
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html