SAP-C02 Question 230
Select 3Your organization has deployed a multi-tier application in an Amazon VPC. The application consists of public-facing web servers in a public subnet and backend database servers in a private subnet. The following requirements must be met:
- Web servers should allow incoming HTTP and HTTPS traffic from the internet.
- Database servers should only accept traffic from the web servers over the default MySQL port.
- Neither the web servers nor the database servers should allow any other inbound traffic.
- All components must be able to initiate outbound traffic to the internet for updates and backups.
Which combination of configurations will meet the requirements?
- A
Attach an Internet Gateway to the VPC and update the route table of the public subnet to direct 0.0.0.0/0 to the Internet Gateway.
- B
Create a security group for the web servers that allows inbound HTTP and HTTPS traffic from 0.0.0.0/0 and outbound traffic to the internet.
- C
Create a security group for the database servers that allows inbound traffic from the web servers' security group on port 3306 and outbound traffic to the internet.
- D
Update the network ACL of the public subnet to allow inbound traffic on ports 80 and 443 from 0.0.0.0/0 and outbound traffic to the internet.
- E
Update the route table of the private subnet to allow 0.0.0.0/0 traffic to the Internet Gateway.
Show answer and explanation
Correct answers: A, B, C
Explanation
The correct solution involves configuring the Internet Gateway and route table for public subnet internet access, using security groups to control traffic between web and database servers, and ensuring outbound traffic is allowed for updates and backups. Relying on security groups instead of network ACLs simplifies management and meets the requirements. Private subnets should not have direct routes to the Internet Gateway but should use a NAT Gateway for outbound internet traffic.
- A. Correct.
Correct. Attaching an Internet Gateway and updating the route table of the public subnet allows the web servers to communicate with the internet for HTTP/HTTPS requests and outbound internet traffic.
- B. Correct.
Correct. The security group for the web servers should explicitly allow inbound HTTP and HTTPS traffic from all sources (0.0.0.0/0) and enable outbound traffic to the internet.
- C. Correct.
Correct. The security group for the database servers should allow inbound traffic only from the web servers' security group on port 3306 and enable outbound traffic for updates and backups.
- D. Incorrect.
Incorrect. While network ACLs can be used for additional control, they are stateless and would require both inbound and outbound rules for communication. Security groups are the recommended solution for this use case.
- E. Incorrect.
Incorrect. The private subnet should not have a route to the Internet Gateway. Instead, outbound internet access for the private subnet can be achieved using a NAT Gateway.