ANS-C01 Question 176
Select 2Your company is hosting a multi-tier web application in an Amazon VPC. The application consists of a public-facing front-end layer (running on EC2 instances in a public subnet) and a back-end database layer (running on RDS in a private subnet). For security and compliance reasons, the database must not be accessible from the internet, and all database queries from the front-end must be encrypted in transit. Which AWS services or configurations should you implement to meet these requirements?
- A
Use a Security Group to allow inbound traffic from the front-end EC2 instances to the RDS database on the database port.
- B
Enable TLS/SSL encryption for the RDS database and configure the front-end application to use encrypted connections.
- C
Place a NAT Gateway in the public subnet to allow the RDS database to connect to the internet securely.
- D
Use a Network ACL to deny all inbound and outbound traffic from the private subnet where the RDS database resides.
- E
Create a VPC Endpoint for Amazon RDS to establish private connectivity between the front-end instances and the database.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements, you need to ensure secure communication between the front-end and back-end layers while keeping the database isolated from the internet. Using Security Groups to control access to the database and enabling TLS/SSL encryption for RDS fulfills these needs. A NAT Gateway, Network ACL denial, or VPC Endpoint are not suitable solutions for this scenario, as they do not address the specific requirements or could disrupt the application.
- A. Correct.
This is correct. Security Groups allow you to control traffic at the instance level. Allowing only the front-end EC2 instances to access the RDS database ensures secure communication within the VPC.
- B. Correct.
This is correct. Enabling TLS/SSL for RDS ensures that all database queries are encrypted in transit, meeting the compliance and security requirements.
- C. Incorrect.
This is incorrect. A NAT Gateway is used to provide internet access for private resources, but it is unnecessary in this scenario since the database should not access the internet.
- D. Incorrect.
This is incorrect. Denying all traffic with a Network ACL would block necessary communication between the front-end and the database, breaking the application.
- E. Incorrect.
This is incorrect. A VPC Endpoint is not required for RDS connectivity. The database instances are already accessible within the VPC without needing an endpoint.