CLF-C02 Question 123
Single answerA company hosts a web application on Amazon EC2 instances in a VPC. They want to ensure that only HTTP and HTTPS traffic is allowed to the instances, while all other traffic is blocked. Which AWS security feature should the company use to achieve this at the instance level?
- A
Security Groups
- B
Network ACLs
- C
AWS WAF
- D
Amazon GuardDuty
Show answer and explanation
Correct answer: A
Explanation
Security Groups are the most appropriate tool for controlling traffic at the instance level in an AWS VPC. They allow specific types of traffic, such as HTTP and HTTPS, to be permitted while blocking all other traffic by default. This makes them the ideal choice in this scenario.
- A. Correct.
Security Groups act as virtual firewalls at the instance level. They can be configured to allow or deny specific types of traffic, such as HTTP and HTTPS, making them the appropriate choice for this scenario.
- B. Incorrect.
Network ACLs are applied at the subnet level, not at the instance level. While they can also control traffic, they are not scoped to specific instances, so they are not the best choice in this case.
- C. Incorrect.
AWS WAF is a web application firewall designed to protect web applications from common web exploits. It does not directly control traffic at the instance level.
- D. Incorrect.
Amazon GuardDuty is a threat detection service that monitors AWS accounts and workloads for malicious activity. It does not control traffic to instances.