ANS-C01 Question 450
Select 3You are designing a multi-tier application hosted on AWS. The application includes a public-facing web tier and a private backend tier that communicates with a database. To secure the application flows, which combination of mechanisms should you implement?
- A
Use a Network Load Balancer (NLB) with SSL/TLS termination for the web tier.
- B
Implement an AWS WAF (Web Application Firewall) to protect the web tier against common web exploits.
- C
Use VPC endpoints to securely connect the backend tier with AWS services like S3.
- D
Enable public IP addresses for the backend tier to allow direct communication with the database.
- E
Configure Security Groups to allow only necessary traffic between the web tier and backend tier.
Show answer and explanation
Correct answers: B, C, E
Explanation
In this scenario, securing the application flows involves implementing an AWS WAF to protect the web tier from common web exploits, using VPC endpoints to ensure secure connectivity for the backend tier, and configuring Security Groups to enforce least privilege and control traffic between the tiers. These measures align with AWS security best practices for a multi-tier application.
- A. Incorrect.
Using a Network Load Balancer (NLB) with SSL/TLS termination is not ideal in this scenario because the NLB does not natively handle SSL/TLS termination. An Application Load Balancer (ALB) would be a better choice for SSL/TLS termination in a web-tier architecture.
- B. Correct.
AWS WAF helps protect the web tier against common web exploits like SQL injection and cross-site scripting (XSS), making it a critical security mechanism for the public-facing web tier.
- C. Correct.
VPC endpoints provide a secure way for private resources (like the backend tier) to access AWS services such as S3 without traversing the public internet, enhancing security.
- D. Incorrect.
Enabling public IP addresses for the backend tier would expose it to the internet, which is not secure or recommended for private backend resources.
- E. Correct.
Configuring Security Groups to allow only specific traffic (e.g., traffic from the web tier to the backend tier on specific ports) is a best practice to limit access and secure inter-tier communication.