SAP-C02 Question 57
Select 3Your company is hosting a web application in a VPC that consists of public and private subnets. The web servers are in a public subnet behind an Application Load Balancer (ALB), while the database servers are in a private subnet. You need to ensure that only the ALB can access the web servers on port 80, and that the database servers only allow traffic from the web servers on port 3306. Additionally, you must ensure that no unintended traffic is allowed. Which steps should you take to satisfy these requirements?
- A
Configure the web server's security group to allow inbound traffic on port 80 only from the ALB's security group.
- B
Modify the public subnet's route table to block all inbound traffic except from the ALB.
- C
Configure the database server's security group to allow inbound traffic on port 3306 only from the web server's security group.
- D
Modify the network ACL associated with the private subnet to deny all inbound traffic on port 3306 except from the web server's security group.
- E
Ensure the ALB's security group allows outbound traffic on port 80 to the web servers' security group.
Show answer and explanation
Correct answers: A, C, E
Explanation
In this scenario, security groups are the primary mechanism for restricting traffic to specific sources and destinations. The web server’s security group should allow traffic from the ALB, while the database server’s security group should allow traffic from the web servers. Additionally, the ALB’s security group must allow outbound traffic to the web servers. Route tables and network ACLs are not required to meet the specific requirements in this case, as the controls are implemented at the security group level, which is stateful and operates at the instance level.
- A. Correct.
Correct: Security groups are stateful, and you can allow inbound traffic from specific sources, such as the ALB's security group, to meet the requirement of restricting access to the web servers on port 80.
- B. Incorrect.
Incorrect: Route tables control routing for subnets and are not used to restrict specific inbound traffic. This step is unnecessary.
- C. Correct.
Correct: Security groups should be configured to allow inbound traffic on port 3306 from the web server’s security group, ensuring access is restricted to only the web servers.
- D. Incorrect.
Incorrect: Network ACLs are stateless and operate at the subnet level. While they can be used to restrict traffic, the scenario explicitly asks for security group-level controls for the database servers, making this option irrelevant.
- E. Correct.
Correct: The ALB's security group must allow outbound traffic on port 80 to ensure it can communicate with the web servers.