CLF-C02 Question 207
Select 2A company has launched an Amazon EC2 instance within a VPC. They want to ensure that only inbound HTTP traffic (port 80) and SSH traffic (port 22) are allowed to the instance, while all other inbound traffic is denied. Which of the following configurations should be implemented to achieve this?
- A
Create a security group for the EC2 instance that allows inbound traffic on port 80 and port 22, and denies all other inbound traffic.
- B
Create a network ACL that allows inbound traffic on port 80 and port 22, and denies all other inbound traffic.
- C
Attach a security group that allows inbound traffic on port 80 and port 22, and configure the default network ACL to allow all traffic.
- D
Configure both a security group and a network ACL to explicitly deny all outbound traffic.
- E
Use the default security group, which already allows all inbound traffic to the EC2 instance.
Show answer and explanation
Correct answers: A, C
Explanation
To secure an EC2 instance, security groups should be configured to allow only the required inbound traffic (HTTP on port 80 and SSH on port 22). Network ACLs are often used for subnet-level traffic control but are not necessary in this scenario since the default network ACL allows all traffic. Combining a properly configured security group with the default network ACL achieves the desired security without unnecessary complexity.
- A. Correct.
This is a correct option. Security groups act as virtual firewalls for EC2 instances and operate at the instance level. By default, they deny all inbound traffic unless explicit rules are defined. Configuring a security group to allow inbound traffic on port 80 and port 22 ensures the desired functionality.
- B. Incorrect.
This is incorrect. Network ACLs operate at the subnet level, not the instance level. While they can be used to control traffic flow, security groups are typically the primary mechanism for securing EC2 instances.
- C. Correct.
This is a correct option. Attaching a security group with appropriate rules ensures instance-level security, while the default network ACL, which allows all traffic, does not interfere with the desired traffic flow.
- D. Incorrect.
This is incorrect. Denying all outbound traffic would block the instance's ability to communicate with external resources, such as downloading updates or accessing APIs, which is not required in the scenario.
- E. Incorrect.
This is incorrect. The default security group allows all inbound traffic only between resources associated with the same security group. It does not restrict traffic according to specific ports, as required in the scenario.