SAA-C03 Question 52
Select 3Your company has deployed an application on an Amazon EC2 instance within a VPC. The application receives requests on port 443 (HTTPS) from external clients and needs to communicate with a database hosted on an Amazon RDS instance on port 3306 (MySQL). To improve security, you need to ensure that only the necessary traffic is allowed to and from the EC2 instance. Which of the following configurations should you implement?
- A
Create a security group rule allowing inbound traffic to the EC2 instance on port 443 from 0.0.0.0/0.
- B
Create a security group rule allowing inbound traffic to the RDS instance on port 3306 from the EC2 instance's security group.
- C
Create a network ACL rule allowing inbound traffic to the EC2 instance on port 443 from 0.0.0.0/0.
- D
Create a security group rule allowing outbound traffic from the EC2 instance to the RDS instance on port 3306.
- E
Create a network ACL rule allowing outbound traffic from the EC2 instance to the RDS instance on port 3306.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure network traffic, security groups are the primary tool for controlling inbound and outbound traffic to and from resources. Here, the EC2 instance requires an inbound rule on port 443 for HTTPS traffic from external clients, while the RDS instance should only allow inbound traffic from the EC2 instance on port 3306. Additionally, the EC2 instance needs an outbound rule to connect to the RDS instance on port 3306. Network ACL rules are not required in this scenario since security groups provide sufficient control.
- A. Correct.
Correct. To allow the EC2 instance to receive HTTPS requests from external clients, you need to allow inbound traffic on port 443 from 0.0.0.0/0 in the security group.
- B. Correct.
Correct. To secure database access, you should configure the RDS instance's security group to allow inbound traffic on port 3306 only from the EC2 instance's security group.
- C. Incorrect.
Incorrect. Although network ACLs can control traffic at the subnet level, this configuration isn't needed here because security groups are sufficient for this scenario.
- D. Correct.
Correct. To allow the EC2 instance to communicate with the RDS instance, you need to allow outbound traffic from the EC2 instance to port 3306 in the security group.
- E. Incorrect.
Incorrect. Network ACLs are not necessary in this scenario since security groups can handle the required traffic controls effectively.