A company operates a two-tier application for image processing. The application uses two Availability Zones, each with one public subnet and one private subnet. An Application Load Balancer (ALB) for the web tier uses the public subnets. Amazon EC2 instances for the application tier use the private subnets. Users report that the application is running more slowly than expected. A security audit of the web server log files shows that the application is receiving millions of illegitimate requests from a small number of IP addresses. A solutions architect needs to resolve the immediate performance problem while the company investigates a more permanent solution. What should the solutions architect recommend to meet this requirement?

The correct solution is to modify the network ACL for the web tier subnets by adding an inbound deny rule for the problematic IP addresses. Network ACLs (NACLs) operate at the subnet level and are stateless, processing rules in order. A deny rule in the NACL will block the illegitimate traffic before it reaches the Application Load Balancer and EC2 instances, immediately mitigating the performance issue. Modifying the inbound security group for the web tier is incorrect because security groups are stateful and process all allow rules before any deny rules (which are not explicitly supported as "deny" rules but rather by absence of "allow"). This would still allow the traffic to reach the ALB. Modifying security groups or NACLs for the application tier is ineffective because the illegitimate requests are targeting the web tier, which is in front of the application tier. Blocking traffic at the application tier would not prevent the web tier from being overwhelmed.