A company runs multiple applications in a single VPC behind an Application Load Balancer that is associated with an AWS WAF web ACL. The security team has identified port scans originating from a specific public IP range. A security engineer must deny requests from that IP range. Which solution will meet these requirements?

The most effective solution is to add an IP set match rule statement to the AWS WAF web ACL. AWS WAF is designed to protect web applications from common web exploits, and an IP set allows you to specify a list of IP addresses or IP address ranges that should be allowed or blocked. This directly addresses the requirement to deny requests from a specific public IP range at the application layer, before they reach the backend instances. Adding a rule to all security groups is less efficient because security groups operate at the instance level. You would need to modify multiple security groups, and the traffic would still reach the Application Load Balancer before being blocked. Creating a rate-based rule is for mitigating high traffic rates, not for blocking specific IP ranges regardless of their request volume. Configuring regex match conditions with a pattern set is used for blocking requests based on patterns in HTTP headers or body, not for IP address filtering.