ANS-C01 Question 442
Select 4You are designing a multi-tier web application hosted on AWS. The application includes a public-facing web tier on Amazon EC2 instances behind an Application Load Balancer (ALB), a private application tier on EC2 instances, and an Amazon RDS database. Which combination of security practices should you implement to address different threat models associated with this architecture?
- A
Use Security Groups to restrict traffic between tiers and allow only necessary ports.
- B
Enable AWS WAF on the Application Load Balancer to block malicious web traffic.
- C
Allow unrestricted access to the database from the application tier to simplify connectivity.
- D
Implement AWS Shield Advanced for DDoS protection on the Application Load Balancer.
- E
Use VPC Flow Logs to monitor and analyze network traffic across all tiers.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
This architecture introduces several potential attack vectors, such as web-based attacks on the public-facing tier, lateral movement between tiers, and DDoS attacks. Using Security Groups enforces strict communication rules between tiers. AWS WAF mitigates web-based attacks, while AWS Shield Advanced protects against DDoS attacks. VPC Flow Logs provide visibility into network traffic, which is vital for detecting and responding to threats. Allowing unrestricted database access, however, is a poor practice and exposes the system to significant risks.
- A. Correct.
Correct. Security Groups are essential to restrict traffic between tiers and minimize the attack surface by allowing only necessary communication.
- B. Correct.
Correct. AWS WAF helps protect the application from malicious web traffic such as SQL injection and cross-site scripting attacks.
- C. Incorrect.
Incorrect. Allowing unrestricted access to the database introduces significant security risks. Network access should be tightly controlled.
- D. Correct.
Correct. AWS Shield Advanced provides advanced DDoS mitigation, which is critical for protecting the public-facing ALB against volumetric attacks.
- E. Correct.
Correct. VPC Flow Logs allow you to monitor and analyze network traffic, helping you detect anomalies and potential security issues.