DOP-C02 Question 380
Select 3Your organization is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must only allow HTTPS traffic from the internet, and specific internal IP ranges (10.0.0.0/16 and 192.168.1.0/24) are allowed to access administrative endpoints. The application must also be protected against common web-based attacks such as SQL injection and DDoS. Which combination of actions should you take to implement these requirements?
- A
Configure an Application Load Balancer listener to accept HTTPS traffic only and terminate SSL at the ALB.
- B
Use a security group to allow inbound HTTPS traffic from 0.0.0.0/0 and restrict traffic from the internal IP ranges to the administrative EC2 instances.
- C
Use AWS WAF to create rules to block SQL injection attacks and attach the WAF web ACL to the Application Load Balancer.
- D
Enable AWS Shield Standard to protect the application against DDoS attacks.
- E
Replace the security group with a network ACL to restrict traffic from 0.0.0.0/0 to administrative endpoints.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure the application, HTTPS traffic must be enforced via the ALB, and SSL termination simplifies certificate management. AWS WAF protects against SQL injection attacks by allowing custom rules to be defined and attached to the ALB. Additionally, enabling AWS Shield Standard provides built-in DDoS protection. Security groups are preferred over network ACLs for this scenario due to their stateful nature and flexibility.
- A. Correct.
Correct. Configuring an ALB listener to accept HTTPS traffic ensures secure communication from the internet, while SSL termination at the ALB simplifies certificate management.
- B. Incorrect.
Incorrect. While security groups can control inbound and outbound traffic, this option does not fully address the requirement to restrict administrative access based on internal IP ranges.
- C. Correct.
Correct. AWS WAF can be used to protect against common web exploits like SQL injection by creating custom rules and attaching them to the ALB.
- D. Correct.
Correct. AWS Shield Standard provides automatic DDoS protection for applications running on AWS, which is necessary to meet the security requirements.
- E. Incorrect.
Incorrect. Network ACLs are stateless and less flexible compared to security groups, making them less suitable for restricting administrative access in this scenario.