ANS-C01 Question 270
Select 2Your organization is hosting a highly sensitive web application on Amazon EC2 instances in a private subnet. To manage inbound traffic, you use an Application Load Balancer (ALB) in a public subnet. The security team has mandated that only traffic from a specific set of IP ranges should be allowed to access the application. Which combination of configurations would best meet this requirement?
- A
Configure the ALB's security group to allow inbound traffic only from the specific IP ranges.
- B
Update the EC2 instances' security group to allow inbound traffic only from the ALB's security group.
- C
Use a network ACL on the private subnet to restrict traffic to the specific IP ranges.
- D
Enable AWS Network Firewall with rules to allow only the specific IP ranges.
- E
Configure the ALB to terminate SSL/TLS and forward decrypted traffic to the EC2 instances.
Show answer and explanation
Correct answers: A, B
Explanation
To secure the application, inbound traffic must be restricted at multiple layers. The ALB's security group ensures that only traffic from the specific IP ranges is allowed to reach the ALB. The EC2 instances' security group further ensures that only traffic originating from the ALB is allowed to reach the application. This layered approach provides effective control over traffic flow while adhering to the principle of least privilege.
- A. Correct.
Correct. The ALB's security group should allow inbound traffic from only the specific IP ranges to meet the requirement of restricting external access.
- B. Correct.
Correct. The EC2 instances' security group should allow inbound traffic only from the ALB's security group to ensure that only traffic processed by the ALB reaches the instances.
- C. Incorrect.
Incorrect. While network ACLs operate at the subnet level, they are stateless and can complicate the configuration. Security groups are generally preferred for this use case.
- D. Incorrect.
Incorrect. AWS Network Firewall is more suitable for advanced use cases, such as deep packet inspection or managing complex traffic patterns. It is overkill for this scenario and unnecessarily complex.
- E. Incorrect.
Incorrect. While terminating SSL/TLS on the ALB is a good practice for secure communication, it does not address the requirement to restrict access to specific IP ranges.