CLF-C02 Question 209
Select 2You are setting up a Virtual Private Cloud (VPC) for a web application that includes a public-facing web server and a backend database. For security, the web server should only accept HTTP and HTTPS traffic from the internet, and the database should only allow connections from the web server. Which of the following configurations should you apply?
- A
Create a security group for the web server allowing inbound HTTP (port 80) and HTTPS (port 443) traffic from 0.0.0.0/0.
- B
Create a security group for the database allowing inbound MySQL (port 3306) traffic from the web server's security group.
- C
Create a network ACL for the web server subnet allowing inbound HTTP and HTTPS traffic from 0.0.0.0/0 and outbound MySQL traffic only to the database subnet.
- D
Create a security group for the web server allowing inbound MySQL (port 3306) traffic from 0.0.0.0/0.
- E
Create a network ACL for the database subnet allowing inbound MySQL traffic from the web server subnet and outbound traffic to 0.0.0.0/0.
Show answer and explanation
Correct answers: A, B
Explanation
Security groups and network ACLs are key tools for managing security in a VPC. In this scenario, the web server needs to serve public traffic (HTTP/HTTPS), and the database should only accept traffic from the web server. Security groups are the optimal choice since they allow for stateful configurations, and using them ensures a secure and least-privilege setup.
- A. Correct.
This is correct because the web server needs to accept HTTP and HTTPS traffic from the internet (0.0.0.0/0) to serve public users.
- B. Correct.
This is correct because the database should only allow inbound MySQL traffic from the web server's security group for secure communication.
- C. Incorrect.
This is incorrect because while network ACLs can be applied, the scenario does not require outbound MySQL traffic from the web server to the database. Security groups are sufficient for this use case.
- D. Incorrect.
This is incorrect because allowing MySQL traffic from 0.0.0.0/0 to the web server is a security risk and violates the principle of least privilege.
- E. Incorrect.
This is incorrect because allowing outbound traffic from the database subnet to 0.0.0.0/0 is unnecessary and poses a security risk.