SAP-C02 Question 232
Select 3Your company is hosting a multi-tier application on AWS. The web servers are in a public subnet, and the application servers are in a private subnet. The web servers need to allow inbound HTTP and HTTPS traffic from the internet, while the application servers should only allow traffic from the web servers over port 8080. There is a compliance requirement to limit access to resources using both stateful and stateless filtering mechanisms. Which combination of configurations satisfies these requirements?
- A
Create a route table for the public subnet with a route to an Internet Gateway and associate it with the subnet.
- B
Create a security group for the web servers that allows inbound HTTP and HTTPS traffic from 0.0.0.0/0.
- C
Add a network ACL rule to the private subnet allowing inbound traffic on port 8080 from the web servers' security group.
- D
Create a security group for the application servers that allows inbound traffic on port 8080 from the web servers' security group.
- E
Add a network ACL rule to the public subnet allowing outbound traffic on port 8080 to the application servers' private IP range.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, the public subnet must have a route to the Internet Gateway for public access. The web servers need a security group that allows inbound HTTP and HTTPS traffic from the internet. The application servers require a security group allowing traffic on port 8080 from the web servers. Network ACLs are not suitable for referencing security groups, and outbound traffic filtering on the public subnet does not address the inbound compliance requirement for the private subnet.
- A. Correct.
This is correct because the public subnet needs a route to the Internet Gateway for the web servers to communicate with the internet.
- B. Correct.
This is correct because the web servers require a security group to allow inbound HTTP (port 80) and HTTPS (port 443) traffic from the internet.
- C. Incorrect.
This is incorrect because network ACLs cannot reference security groups. Network ACLs are stateless and operate on CIDR ranges, not security groups.
- D. Correct.
This is correct because the application servers need a security group to allow inbound traffic on port 8080 from the web servers.
- E. Incorrect.
This is incorrect because while outbound traffic might need to be configured in the network ACL, the scenario requires inbound filtering on the private subnet for compliance, not outbound filtering on the public subnet.