SAP-C02 Question 58
Select 2Your organization is hosting a multi-tier web application in a VPC. The architecture includes a public-facing Application Load Balancer (ALB) in the public subnet, web servers in a private subnet, and a database in another private subnet. The web servers need to connect to the database, but the database must never be accessible from the internet. The security team has asked you to ensure that the architecture adheres to the following requirements:
- The ALB should only allow HTTP traffic from the internet on port 80.
- The web servers should only accept traffic from the ALB and send traffic to the database.
- The database subnet should only accept traffic from the web servers.
Which of the following actions should you take to meet the requirements? (Choose TWO)
- A
Configure the security group on the ALB to allow inbound traffic on port 80 from 0.0.0.0/0.
- B
Configure the security group on the web servers to allow inbound traffic on port 80 only from the ALB's security group.
- C
Configure the network ACL for the database subnet to allow inbound traffic on port 3306 only from the web servers' private IP range.
- D
Configure the security group on the database to allow inbound traffic on port 3306 from the web servers' security group.
- E
Configure a route in the route table for the database subnet to direct traffic to the ALB.
Show answer and explanation
Correct answers: B, D
Explanation
To meet the security and access requirements, the ALB must allow internet traffic on port 80, the web servers must only accept traffic from the ALB, and the database must only accept traffic from the web servers. Security groups are the most appropriate AWS feature to enforce these rules because they are stateful, resource-specific, and can reference other security groups directly. Network ACLs and route tables serve different purposes and are not as effective or straightforward for this scenario.
- A. Incorrect.
This is incorrect. The ALB should allow inbound traffic on port 80 from the internet (0.0.0.0/0), but this does not address the requirements around securing traffic flow between the web servers and database.
- B. Correct.
This is correct. Security groups can reference other security groups, and configuring the web servers' security group to allow traffic only from the ALB's security group ensures that only the ALB can communicate with the web servers.
- C. Incorrect.
This is incorrect. While network ACLs can be used, it is more effective and specific to use security groups to restrict traffic to the database. Network ACLs operate at the subnet level and are stateless, which may introduce complexity.
- D. Correct.
This is correct. Configuring the database security group to allow inbound traffic on port 3306 only from the web servers' security group ensures that only the web servers can communicate with the database.
- E. Incorrect.
This is incorrect. Route tables control traffic direction within a VPC, but they do not directly enforce security or restrict access between resources.