ANS-C01 Question 454
Select 2An organization needs to design a secure network architecture in AWS to meet compliance requirements for sensitive data. The solution must ensure that their application servers can only communicate with the database servers over specific ports, and all internet access is routed through a centralized inspection layer for logging and threat detection. Which combination of solutions meets these requirements?
- A
Use security groups to allow traffic between application servers and database servers over the required ports.
- B
Configure a NAT Gateway in a public subnet to enable internet access for private subnets.
- C
Deploy a Transit Gateway for centralized routing and connect it to a Network Firewall for traffic inspection.
- D
Use Network ACLs to define fine-grained rules for east-west traffic between application servers and database servers.
- E
Implement VPC endpoints to route traffic directly to AWS services without traversing the internet.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the compliance and security requirements, traffic between the application servers and the database servers should be controlled using security groups, which are stateful and allow fine-grained rule definitions. Additionally, centralized traffic inspection can be achieved by routing all internet-bound traffic through a Transit Gateway connected to a Network Firewall, ensuring compliance with logging and threat detection requirements.
- A. Correct.
Allowing traffic between the application servers and database servers over specific ports is a best practice and can be accomplished using security groups, which are stateful and allow fine-grained control.
- B. Incorrect.
While a NAT Gateway enables internet access for private subnets, it does not provide the centralized inspection layer required for compliance.
- C. Correct.
Deploying a Transit Gateway and connecting it to a Network Firewall ensures that all internet-bound traffic can be routed through the firewall for logging and threat inspection, thus meeting the compliance requirements.
- D. Incorrect.
Network ACLs (NACLs) are stateless and typically used for broader subnet-level control. They are not ideal for the fine-grained control required to restrict traffic between application servers and database servers.
- E. Incorrect.
VPC endpoints are used to privately connect to AWS services without internet traversal, but they do not fulfill the requirement for centralized inspection of all internet-bound traffic.