You have deployed a multi-tier Web Application in an AWS cloud. Web servers, Application servers & Database servers are deployed in US East Region. For High availability, Application Load Balancers are configured in the front end to balance traffic across Multiple AZ’s in this region.
For Caching of data, you are using Amazon CloudFront at edge locations. The security team has received a list of blacklist IP address deemed as Spammers. They want you to immediately block these IP addresses at the farthest point from cloud infrastructure. Which of the following is the correct option to block IP addresses?

Answer options:

A.In the US WEST region, create Web ACL, to block all IP address & apply it at edge level CloudFront.
B.At the Global level, create Web ACL, to block all IP address & apply it at edge level CloudFront.
C.In each AZ of the US East region, create Web ACL to block all IP address & apply it at Application Load Balancer.
D.In the US East region, create Web ACL to block all IP addresses & apply it at Application Load Balancer.

Correct Answer: B
AWS WAF can be used to detect & block the following.
IP Address & Range
Patterns in HTTP headers & Body.
URL string patterns
SQL injection
Cross-Site scripting.
Geographical Locations.
This AWS WAF can be executed at edge locations on Amazon CloudFront or at Application Load Balancers at the regional level. Since it is required to apply this Web ACL at the farthest point from a Web application, it needs to apply at edge location Amazon CloudFront at Global level.
Option A is incorrect as AWS WAF is available globally for a CloudFront distribution, but you must use the Region US East (N. Virginia) for all of your work. You must create your web ACL using the Region US East (N. Virginia). 
Option C is incorrect. Since it requires blocking IP address at the farthest point from cloud infrastructure, it needs to apply at Amazon CloudFront & not at Application Load Balancer. Also, Web ACL is applied at the regional level.
Option D is incorrect. Since it requires blocking IP address at the farthest point from cloud infrastructure, it needs to apply at Amazon CloudFront & not at Application Load Balancer.
For more information on WAF, refer to the following URL-
https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works.html