ANS-C01 Question 61
Select 2Your organization is migrating a multi-tier web application to AWS. The architecture includes a public-facing Application Load Balancer (ALB) in front of an Auto Scaling group of web servers, and a backend tier connecting to an Amazon RDS database. You need to improve security and ensure that the database is only accessible from the web servers. How should you configure the networking architecture to meet this requirement?
- A
Place the web servers in a public subnet and the database in a private subnet.
- B
Configure a security group for the RDS database to only allow inbound traffic from the security group assigned to the web servers.
- C
Add a Network ACL to the private subnet to allow inbound traffic from the public subnet where the web servers reside.
- D
Enable VPC Flow Logs to monitor traffic between the web servers and the RDS database.
- E
Use an AWS Direct Connect connection to ensure secure communication between the web servers and the database.
Show answer and explanation
Correct answers: B, C
Explanation
To secure the database, it should be placed in a private subnet, and access to it should be tightly controlled. Using a security group to allow only traffic from the web servers' security group ensures that only the web servers can communicate with the database. Additionally, Network ACLs can provide subnet-level protection, adding an extra layer of security to the architecture. Other options, like enabling VPC Flow Logs or using AWS Direct Connect, do not directly address the requirement of restricting access between the web servers and the database.
- A. Incorrect.
Placing the web servers in a public subnet would expose them directly to the internet, which is not a recommended best practice for securing the backend tier.
- B. Correct.
This is a correct approach. Security groups support referencing other security groups, allowing you to restrict communication to only the intended resources (in this case, the web servers and the database).
- C. Correct.
This is a correct approach. Network ACLs can be used at the subnet level as an additional layer of security to control traffic between subnets.
- D. Incorrect.
While enabling VPC Flow Logs is useful for monitoring and troubleshooting, it does not directly contribute to restricting access between the web servers and the database.
- E. Incorrect.
AWS Direct Connect is unrelated to this scenario, as it is primarily used for establishing a dedicated network connection between on-premises data centers and AWS.