SAP-C02 Question 229
Select 3You are designing a highly available web application hosted on Amazon EC2 instances within a VPC. The application needs to securely communicate with an Amazon RDS database, while ensuring that only web traffic is allowed from the internet. Additionally, you must restrict traffic to the database to only the application servers. How can you configure the network to meet these requirements?
- A
Use a route table to direct internet traffic to the NAT Gateway for the EC2 instances and allow inbound web traffic on port 80 in the security group of the instances.
- B
Configure a security group for the EC2 instances to allow inbound traffic from the internet on port 80 and restrict outbound traffic to the database security group on port 3306.
- C
Configure the RDS security group to allow inbound traffic only from the security group of the EC2 instances on port 3306.
- D
Use a Network ACL to allow inbound traffic from the internet on port 80 and outbound traffic to the database on port 3306.
- E
Ensure the route table associated with the public subnet has a route to an Internet Gateway.
Show answer and explanation
Correct answers: B, C, E
Explanation
To securely configure the network, security groups should be used to control access to both the EC2 instances and the RDS database, as they are stateful and provide application-level security. The EC2 instances must allow inbound web traffic on port 80, and outbound traffic to the RDS database should be restricted to the database's security group on port 3306. The RDS security group should only allow inbound traffic from the EC2 security group on port 3306. Additionally, the route table for the public subnet must include a route to an Internet Gateway to enable communication with the internet. Network ACLs, while useful for subnet-level control, are not the best choice in this scenario.
- A. Incorrect.
Incorrect. A NAT Gateway is used for instances in private subnets to access the internet, which is not applicable here as the EC2 instances must handle inbound web traffic directly.
- B. Correct.
Correct. The security group for the EC2 instances should allow inbound traffic on port 80 for web traffic and restrict outbound traffic to the database security group on port 3306 for secure communication.
- C. Correct.
Correct. The RDS security group should allow inbound traffic only from the security group of the EC2 instances on port 3306 to ensure that only the application servers can access the database.
- D. Incorrect.
Incorrect. Network ACLs are stateless, and while they can be used to control traffic, security groups are the recommended method for application-level restrictions. Using a Network ACL here would not be the most effective solution.
- E. Correct.
Correct. The route table associated with the public subnet must have a route to an Internet Gateway to allow the EC2 instances to communicate with the internet for inbound and outbound traffic.