ANS-C01 Question 441
Select 3You are designing a multi-tier web application hosted on AWS. The application consists of a public-facing web tier, an application tier, and a database tier. The web tier is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB), the application tier communicates with the database using Amazon RDS, and sensitive user data is transmitted over the network. Which combination of security measures best addresses potential threat models for this architecture?
- A
Enable WAF (Web Application Firewall) on the Application Load Balancer to protect against SQL injection and cross-site scripting (XSS) attacks.
- B
Encrypt communication between the application tier and the database using SSL/TLS.
- C
Use an EC2 Security Group with an open 0.0.0.0/0 rule to allow traffic to the application tier for maximum flexibility.
- D
Implement VPC endpoint services for the database tier to prevent public exposure of the database.
- E
Enable DDoS protection using AWS Shield Advanced for the Application Load Balancer.
Show answer and explanation
Correct answers: A, B, E
Explanation
To address threat models for a multi-tier application, it's essential to protect against both application-level attacks and network-level vulnerabilities. AWS WAF mitigates common web application threats, SSL/TLS encryption secures sensitive data in transit, and AWS Shield Advanced defends against DDoS attacks. Avoid configurations like overly permissive Security Groups, which increase the attack surface, and note that certain measures like VPC endpoints are unnecessary for RDS, as it operates within the VPC by default.
- A. Correct.
Correct. Enabling AWS WAF on the ALB helps mitigate application layer threats, such as SQL injection and cross-site scripting, which are common attack vectors for web applications.
- B. Correct.
Correct. Encrypting communication between the application tier and the database using SSL/TLS ensures the confidentiality and integrity of sensitive user data in transit.
- C. Incorrect.
Incorrect. Allowing traffic from 0.0.0.0/0 in the Security Group is a poor security practice and exposes the application tier to potential unauthorized access.
- D. Incorrect.
Incorrect. While implementing a VPC endpoint service could enhance security, it is not applicable for Amazon RDS, as RDS is accessed within the VPC by default and does not need a VPC endpoint.
- E. Correct.
Correct. AWS Shield Advanced provides enhanced DDoS protection, which is critical for a public-facing component like an Application Load Balancer.