SAA-C03 Question 50
Select 2Your company runs a web application hosted on an EC2 instance in a public subnet of a VPC. To improve security, you are tasked with ensuring that only HTTP (port 80) and HTTPS (port 443) traffic from the internet can access the EC2 instance, while blocking all other traffic. Which configuration changes should you make to implement this requirement?
- A
Configure the Security Group attached to the EC2 instance to allow inbound traffic only on ports 80 and 443 from 0.0.0.0/0.
- B
Update the Network ACL associated with the subnet to allow inbound traffic on ports 80 and 443 from 0.0.0.0/0 and deny all other inbound traffic.
- C
Create a new route in the subnet's route table to explicitly allow traffic on ports 80 and 443.
- D
Remove the default outbound rule in the Security Group that allows all traffic.
- E
Disable the default VPC DNS resolver to prevent unauthorized traffic.
Show answer and explanation
Correct answers: A, B
Explanation
To control ports, protocols, and network traffic, you need to configure both Security Groups and Network ACLs. Security Groups operate at the instance level and allow or deny specific inbound and outbound traffic. Network ACLs operate at the subnet level and provide an additional layer of control. By configuring both correctly, you ensure that only HTTP and HTTPS traffic can reach the EC2 instance, while blocking all other traffic.
- A. Correct.
Correct. Security Groups act as a virtual firewall for your EC2 instance and control which traffic can reach it. Allowing only inbound traffic on ports 80 and 443 ensures that only HTTP/HTTPS traffic can access the instance.
- B. Correct.
Correct. Network ACLs provide an additional layer of security at the subnet level. By explicitly allowing inbound traffic on ports 80 and 443 and denying all other inbound traffic, you meet the requirement.
- C. Incorrect.
Incorrect. Route tables are used to control traffic routing at the subnet level, but they do not control specific ports or protocols. This option does not achieve the desired outcome.
- D. Incorrect.
Incorrect. Outbound rules in the Security Group are not relevant to the requirement as the question focuses on controlling inbound traffic.
- E. Incorrect.
Incorrect. Disabling the default VPC DNS resolver will not affect the control of ports and protocols for the EC2 instance. This is unrelated to the scenario.