DOP-C02 Question 91
Select 3Your team is deploying a containerized application to Amazon ECS using AWS Fargate. The application processes sensitive customer data and must comply with strict security regulations. As part of the deployment, you need to ensure that the application is running in a secure environment with minimal exposure to external threats. Which actions should you take to achieve this?
- A
Deploy the ECS service into private subnets and configure a NAT Gateway for outbound internet access.
- B
Enable AWS WAF on the ECS service to protect against common web application attacks.
- C
Use a security group to restrict inbound traffic to only specific IP addresses and ports required by the application.
- D
Configure VPC Endpoint for Amazon ECS to ensure communication between ECS tasks and AWS services stays within the AWS network.
- E
Deploy the ECS tasks using a public-facing Application Load Balancer for easy access.
Show answer and explanation
Correct answers: A, C, D
Explanation
To comply with strict security requirements, deploying ECS tasks into private subnets, restricting inbound traffic using security groups, and using VPC Endpoints for internal communication are critical steps. These configurations minimize exposure to external threats and ensure secure communication within the AWS environment. Using a public-facing load balancer or relying on AWS WAF would not align with the goal of minimizing exposure in this specific scenario.
- A. Correct.
Deploying the ECS service into private subnets ensures that tasks are not directly accessible from the internet, providing an additional layer of security. A NAT Gateway provides controlled outbound internet access if needed.
- B. Incorrect.
AWS WAF is used for web application protection, but it is not directly applicable to securing an ECS service running in private subnets. This option is irrelevant in this scenario.
- C. Correct.
Security groups are essential for controlling inbound traffic to ECS tasks. Restricting access to specific IP addresses and ports reduces exposure to unauthorized access.
- D. Correct.
Using a VPC Endpoint for ECS ensures that communication between ECS tasks and AWS services stays within the AWS network, reducing the risk of data exposure to the public internet.
- E. Incorrect.
Deploying ECS tasks using a public-facing Application Load Balancer makes the application publicly accessible, which is contrary to the requirement of minimizing exposure to external threats.