ANS-C01 Question 267
Select 2Your organization has deployed a three-tier web application in a VPC. The architecture includes a public-facing application load balancer (ALB) in a public subnet, web servers in a private subnet, and a database in another private subnet. You need to ensure that only the ALB can communicate with the web servers, and the database can only be accessed by the web servers. Which combination of configurations is the MOST secure and effective?
- A
Create an inbound rule in the web servers' security group to allow traffic only from the ALB’s security group.
- B
Create a network ACL for the web servers' subnet that allows inbound traffic only from the ALB’s IP address range.
- C
Create an inbound rule in the database's security group to allow traffic only from the web servers' security group.
- D
Create an outbound rule in the ALB’s security group to allow traffic only to the web servers' IP address range.
- E
Create an outbound rule in the web servers' security group to allow traffic only to the database's IP address range.
Show answer and explanation
Correct answers: A, C
Explanation
The most secure and effective approach is to use security groups to control access because they are stateful and allow for dynamic management. In this case, the web servers' security group should allow inbound traffic only from the ALB’s security group, and the database's security group should allow inbound traffic only from the web servers' security group. This ensures that only the intended components can communicate with each other, while other traffic is blocked. Network ACLs and outbound rules are less suitable or redundant for this scenario.
- A. Correct.
This is correct. Security groups are stateful and using the ALB’s security group as a source ensures only the ALB can access the web servers.
- B. Incorrect.
This is incorrect. While network ACLs are stateless and can restrict traffic, using security groups is simpler and more dynamic in this scenario.
- C. Correct.
This is correct. Configuring the database's security group to only allow traffic from the web servers' security group ensures secure and specific access.
- D. Incorrect.
This is incorrect. Outbound rules in the ALB’s security group are unnecessary for this scenario, as the ALB only receives traffic and forwards it to the web servers.
- E. Incorrect.
This is incorrect. Outbound rules in the web servers' security group are not needed because the database's security group already controls access.