SAA-C03 Question 55
Single answerA company is deploying an internal web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application should only be accessible to employees who authenticate through the company's identity provider using SAML-based Single Sign-On (SSO). Which solution securely meets this requirement?
- A
Configure the ALB to use an AWS WAF rule that blocks all traffic except requests from the company's IP range.
- B
Enable authentication on the ALB and integrate it with the company's SAML-based identity provider.
- C
Use an IAM policy on the EC2 instances to restrict access to employees authenticated by the company's identity provider.
- D
Deploy a VPN connection between the company's network and the VPC, and route all application traffic through the VPN.
Show answer and explanation
Correct answer: B
Explanation
Enabling authentication on the Application Load Balancer (ALB) and integrating it with the company's SAML-based identity provider is the most secure and scalable solution. This approach enforces user authentication through SSO before granting access to the web application, which aligns with the company's requirements. Other options either do not provide user-level authentication or introduce unnecessary complexity without addressing the specific need for SAML-based SSO.
- A. Incorrect.
This option uses AWS WAF to filter traffic by IP range, but it does not ensure that users are authenticated through the company's SAML-based identity provider. It might block unauthorized users, but it doesn't provide the desired SSO capability.
- B. Correct.
This option is correct because ALB supports user authentication via OIDC and SAML-based identity providers. By enabling authentication on the ALB and integrating it with the company's SAML-based identity provider, the application can enforce secure access and SSO for employees.
- C. Incorrect.
IAM policies control access to AWS resources, not web application traffic. This approach cannot enforce authentication at the application level via SAML.
- D. Incorrect.
A VPN connection would allow secure network-level access but does not enforce user-level authentication or SAML-based SSO for the application. It also adds unnecessary complexity.