ANS-C01 Question 268
Select 2An organization is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. To improve security, the organization wants to ensure that only traffic from their corporate IP range can access the application, while blocking all other incoming traffic. Which combination of configuration steps will achieve this?
- A
Create a security group for the EC2 instances and allow inbound traffic only from the corporate IP range.
- B
Configure an inbound rule in the ALB security group to allow traffic only from the corporate IP range.
- C
Set up a network ACL on the VPC subnets to allow inbound traffic only from the corporate IP range and deny all other traffic.
- D
Deploy AWS Network Firewall and create a rule to explicitly allow traffic only from the corporate IP range.
- E
Enable AWS WAF on the ALB and configure a rule to block traffic originating outside the corporate IP range.
Show answer and explanation
Correct answers: A, B
Explanation
To restrict access to the web application to the corporate IP range, you need to configure both the EC2 instance security group and the ALB security group. Security groups are stateful and allow fine-grained control over traffic. While other options like network ACLs or AWS WAF could further enhance security, they are not necessary for this specific requirement. Configuring security groups at both the EC2 and ALB levels ensures that unauthorized traffic is blocked at multiple layers.
- A. Correct.
Correct: Security groups are stateful and should be configured to allow traffic to the EC2 instances only from the trusted corporate IP range.
- B. Correct.
Correct: The ALB security group should also be configured to allow traffic only from the corporate IP range to ensure unauthorized traffic does not reach the load balancer.
- C. Incorrect.
Incorrect: Network ACLs are stateless and might block return traffic if not configured properly. While they can control access at the subnet level, they are not required in this scenario as security groups are sufficient.
- D. Incorrect.
Incorrect: AWS Network Firewall is not necessary here; security groups and ALB settings can achieve the desired traffic filtering. Network Firewall is typically used for advanced traffic inspection.
- E. Incorrect.
Incorrect: AWS WAF is primarily used to protect web applications from common exploits like SQL injection or XSS and is not designed for IP-based filtering in this scenario.