ANS-C01 Question 452
Select 3Your company is deploying a multi-tier web application on AWS. The application consists of a public-facing web tier in an Amazon EC2 Auto Scaling group, a private application tier also running on EC2 instances, and a database tier using Amazon RDS. You need to secure application flows between these tiers while ensuring compliance with security best practices. Which of the following mechanisms should you implement?
- A
Use Security Groups to control traffic between the web, application, and database tiers.
- B
Enable encryption in transit for communication between the application and database tiers using SSL/TLS.
- C
Deploy an AWS WAF (Web Application Firewall) to protect traffic between the application tier and database tier.
- D
Use Network ACLs to restrict traffic between tiers at the subnet level.
- E
Configure VPC endpoints for inter-tier communication to avoid using the public internet.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing application flows in a multi-tier architecture involves using mechanisms such as Security Groups to control traffic, enabling SSL/TLS for encryption in transit, and optionally using Network ACLs for subnet-level restrictions. AWS WAF and VPC endpoints do not apply to the specific scenario of securing inter-tier communication within a VPC. By implementing these security measures, you ensure compliance with best practices for securing application flows between tiers.
- A. Correct.
Correct. Security Groups are stateful firewalls that allow you to control inbound and outbound traffic for EC2 instances. They are commonly used to secure inter-tier communication in multi-tier architectures.
- B. Correct.
Correct. Encrypting data in transit using SSL/TLS ensures secure communication between services, such as the application and database tiers, aligning with security best practices.
- C. Incorrect.
Incorrect. AWS WAF is designed to protect web applications from common web exploits but is not used for securing traffic between internal tiers like the application and database tiers.
- D. Correct.
Correct. Network ACLs provide an additional layer of security at the subnet level and can be used to restrict traffic between tiers. However, they are stateless and complement Security Groups.
- E. Incorrect.
Incorrect. VPC endpoints are used to connect to AWS services privately without using the public internet but are not relevant for securing communication between tiers in the same VPC.