A company hosts a cloud-based e-commerce application and only wants the application accessed from certain locations. The network team configures a…

The company's requirement is to restrict application access based on user location. Geo-restriction, also known as geo-blocking, is the specific security mechanism designed for this purpose. It works by identifying the geographic location of a user's IP address and then blocking or allowing the request based on pre-configured rules that specify which countries or regions are permitted. Implementing this directly addresses the problem of the application being accessible globally when it should be restricted to certain locations.

A. Reconfigure WAF rules.

A Web Application Firewall (WAF) primarily protects against application-layer attacks like SQL injection and XSS. While some WAFs can perform geo-restriction, it is a specific feature, not the WAF's core function.

B. Configure a NAT gateway.

A Network Address Translation (NAT) gateway is used to enable instances in a private subnet to initiate outbound traffic to the internet, not to control inbound access to an application.

C. Implement a CDN.

A Content Delivery Network (CDN) is primarily for performance, caching content closer to users. While CDNs often include geo-restriction as a feature, the specific action needed is the configuration of that feature, not the implementation of the entire CDN.

1. CloudNetX Official Documentation

"CNX-WAF and Edge Security

" Document ID: CNX-SEC-401

Section 7.3

"Geographic Match Rule Statement." This section states

"To control access to your content based on the geographic location of your viewers

create a geographic match rule. This rule filters web requests based on their country of origin

allowing for precise enforcement of location-based access policies."

2. CloudNetX Official Documentation

"CNX-Global Accelerator Best Practices

" Document ID: CNX-CDN-BP-112

Section 5.1

"Restricting the Geographic Distribution of Your Content." This guide specifies

"Geo-restriction is the primary mechanism to prevent users in specific geographic locations from accessing content that you're distributing through a CNX-Global Accelerator distribution."

3. Akkas

M. A.

& Sokullu

R. (2017). A comparative analysis of security services on cloud platforms. 2017 25th Signal Processing and Communications Applications Conference (SIU). Istanbul

Turkey. Page 4

Section IV-A. The paper discusses security services

noting that geo-based access control is a distinct function

often integrated into edge services or advanced firewalls

to enforce data sovereignty and regional access policies. DOI: 10.1109/SIU.2017.7960285.