CLF-C02 Question 208
Select 2You are configuring a Virtual Private Cloud (VPC) in AWS for a web application. The application has an EC2 instance running as a web server in a public subnet. To secure the environment, you want to ensure that the EC2 instance only accepts HTTP (port 80) traffic from the internet and blocks all other incoming requests. Which of the following configurations will meet this requirement?
- A
Create a security group that allows inbound traffic on port 80 from 0.0.0.0/0 and assign it to the EC2 instance.
- B
Configure a network ACL to allow inbound traffic on port 80 from 0.0.0.0/0 and allow all outbound traffic.
- C
Create a security group that denies all traffic except port 80 and apply it to the EC2 instance.
- D
Configure a network ACL that denies all inbound traffic except port 80 and apply it to the public subnet.
- E
Create a security group that allows all inbound traffic and assign it to the EC2 instance.
Show answer and explanation
Correct answers: A, B
Explanation
To secure a web server in a public subnet, you must configure both security groups and network ACLs appropriately. Security groups control traffic at the instance level, while network ACLs operate at the subnet level. Allowing HTTP traffic on port 80 in both ensures the application is accessible to users while maintaining a secure environment. Denying all inbound traffic or allowing all traffic would either block necessary communication or introduce security risks.
- A. Correct.
Correct: Security groups act as a virtual firewall at the instance level. Allowing inbound HTTP traffic on port 80 from 0.0.0.0/0 ensures the web server is accessible from the internet.
- B. Correct.
Correct: Network ACLs operate at the subnet level and provide an additional layer of security. Allowing inbound HTTP traffic on port 80 ensures the subnet permits the traffic, while allowing all outbound traffic ensures responses can leave the subnet.
- C. Incorrect.
Incorrect: Security groups do not support explicit deny rules. They operate using allow rules only, so denying all traffic except port 80 is not a valid configuration.
- D. Incorrect.
Incorrect: While network ACLs can explicitly deny traffic, applying a network ACL that denies all inbound traffic except port 80 would block necessary traffic such as DNS and ICMP, potentially affecting the instance's functionality.
- E. Incorrect.
Incorrect: Allowing all inbound traffic using a security group would expose the EC2 instance to unnecessary risks, violating the principle of least privilege.