ANS-C01 Question 269
Select 3Your company has deployed a three-tier web application on AWS. The application stack consists of an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group for the application layer, and an Amazon RDS database in a private subnet. To comply with your organization's security policy, you need to ensure that only traffic from the internet to the ALB and only traffic from the ALB to the EC2 instances is allowed. Additionally, you must ensure that the database can only be accessed by the EC2 instances. Which of the following configurations should you implement to meet the requirements?
- A
Configure the ALB security group to allow inbound traffic only from the internet on ports 80 and 443.
- B
Attach a security group to the EC2 instances that allows inbound traffic only from the ALB's security group on the required application port.
- C
Use a network ACL on the private subnet hosting the EC2 instances to allow traffic from the ALB's IP addresses.
- D
Attach a security group to the RDS database that allows inbound traffic only from the EC2 instances' security group on the database port.
- E
Use AWS Network Firewall to block all traffic to the EC2 instances except from the ALB.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure the three-tier architecture, you need to configure security groups effectively. The ALB security group should allow inbound traffic only from the internet on ports 80 and 443. The EC2 instances' security group should allow inbound traffic only from the ALB's security group to ensure the application layer is accessed only through the load balancer. Similarly, the RDS database's security group should allow inbound traffic only from the EC2 instances' security group to prevent unauthorized access to the database. Network ACLs and AWS Network Firewall are not necessary for this specific scenario and would add unnecessary complexity.
- A. Correct.
This is correct because the ALB security group must allow inbound traffic only from the internet on the HTTP/HTTPS ports (80 and 443) to ensure no other unwanted traffic reaches the ALB.
- B. Correct.
This is correct because the EC2 instances' security group should allow inbound traffic only from the ALB's security group to restrict access to the application layer from other sources.
- C. Incorrect.
This is incorrect because network ACLs could be used, but they are stateless and require additional complexity for managing rules. Security groups are better suited for this scenario.
- D. Correct.
This is correct because the RDS database security group should allow inbound traffic only from the EC2 instances' security group to ensure the database is not exposed to other traffic sources.
- E. Incorrect.
This is incorrect because AWS Network Firewall, while useful for inspecting and filtering traffic at the VPC level, is not required for this scenario and would add unnecessary complexity.