DOP-C02 Question 345
Single answerYour company is running an application on Amazon ECS with tasks deployed in an Auto Scaling group behind an Application Load Balancer (ALB). The security team has identified a potential vulnerability where unauthorized IP addresses are attempting to access the application. You need to restrict access to the application to only allow traffic from a specific range of IP addresses defined by the security team. How can you implement this restriction in the most secure and efficient manner?
- A
Configure a security group on the ECS tasks to allow inbound traffic only from the specific IP range.
- B
Create a Web Application Firewall (WAF) rule and associate it with the ALB to allow traffic only from the specific IP range.
- C
Modify the Network ACLs of the subnets where the ECS tasks are deployed to allow traffic only from the specific IP range.
- D
Add a listener rule to the ALB to forward traffic only from the specific IP range to the ECS tasks.
Show answer and explanation
Correct answer: B
Explanation
The best way to restrict access to the application based on IP ranges is to use AWS WAF. It provides a flexible and scalable solution to define IP-based rules and integrate seamlessly with the ALB. Security groups and Network ACLs could also restrict IP ranges but are not as efficient or manageable for application-level filtering. Listener rules on the ALB cannot perform IP-based filtering.
- A. Incorrect.
Security groups are stateful and can restrict traffic based on IP ranges, but they are applied at the instance level. While this could work, it is not the most efficient way to enforce restrictions for applications behind an ALB.
- B. Correct.
AWS WAF is the most appropriate solution for this use case. By creating an IP match condition rule and associating it with the ALB, you can efficiently and securely restrict traffic based on IP ranges at the application layer.
- C. Incorrect.
Network ACLs are stateless and operate at the subnet level. While they could be used to restrict traffic by IP range, they are less flexible and harder to manage in dynamic environments compared to AWS WAF.
- D. Incorrect.
ALB listener rules are used for routing traffic based on conditions like path or host headers. They cannot directly filter traffic based on IP addresses.