SAA-C03 Question 51
Single answerA company is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is accessible over HTTPS, and the company wants to ensure that only HTTPS traffic is allowed to reach the instances. How can the company achieve this?
- A
Configure the ALB to redirect all HTTP traffic to HTTPS.
- B
Modify the ALB's security group to allow only inbound traffic on port 443.
- C
Set up a Network ACL to block all traffic except for HTTPS on port 443.
- D
Add a rule to the EC2 instance security group to allow HTTPS traffic and block all other traffic.
Show answer and explanation
Correct answer: B
Explanation
To ensure that only HTTPS traffic reaches the EC2 instances, the correct approach is to modify the Application Load Balancer's security group to allow inbound traffic only on port 443, which is used for HTTPS. This ensures that any non-HTTPS traffic is blocked before it reaches the ALB, aligning with the company's requirement for secure communication.
- A. Incorrect.
This option ensures that HTTP traffic is redirected to HTTPS, but it does not restrict HTTP traffic from reaching the ALB itself.
- B. Correct.
This is the correct answer. By modifying the ALB's security group to allow only inbound traffic on port 443, the ALB can accept only HTTPS traffic and block all other protocols and ports.
- C. Incorrect.
While Network ACLs can control traffic at the subnet level, they are not the optimal solution in this case. Security groups are more granular and are sufficient for this requirement.
- D. Incorrect.
This would block all traffic except HTTPS at the EC2 instance level, but it does not address the traffic reaching the ALB. The ALB's security group is the better place to enforce this rule.