SAP-C02 Question 59
Select 3Your company is hosting a multi-tier web application in a VPC. The application consists of a public-facing web tier hosted on EC2 instances in a public subnet and a private database tier hosted on EC2 instances in a private subnet. You must ensure that:
- The web servers can receive traffic from the internet.
- The web servers can communicate with the database servers.
- The database servers should not be directly accessible from the internet.
Which combination of configurations will meet these requirements?
- A
Associate a route table with the public subnet that has a route directing 0.0.0.0/0 traffic to an internet gateway.
- B
Attach a security group to the web servers that allows inbound traffic from the internet on port 80.
- C
Attach a security group to the database servers that allows inbound traffic only from the web servers' security group on the required database port.
- D
Configure a network ACL for the public subnet to allow inbound traffic from the internet on port 80 while denying all other inbound traffic.
- E
Configure a network ACL for the private subnet to allow inbound traffic from the internet on the required database port.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirements, the public subnet's route table must allow internet traffic, the web servers' security groups must allow inbound traffic from the internet on port 80, and the database servers' security groups must allow inbound traffic only from the web servers' security group. Using network ACLs to completely block or allow traffic in this scenario is less effective and does not align with the principle of least privilege. Security groups provide more granular control for these use cases.
- A. Correct.
This is correct. A route table associated with the public subnet must have a route to direct internet traffic (0.0.0.0/0) to the internet gateway to ensure the web servers in the public subnet can receive traffic from the internet.
- B. Correct.
This is correct. The security group attached to the web servers must explicitly allow inbound traffic from the internet on port 80 (HTTP) to serve web requests.
- C. Correct.
This is correct. The security group attached to the database servers should allow inbound traffic only from the web servers' security group, ensuring secure communication between the web and database tiers while preventing direct internet access to the database servers.
- D. Incorrect.
This is incorrect. While network ACLs can be used to control traffic, using them to allow only port 80 traffic would block other necessary traffic such as SSH or health checks. Security groups are better suited for granular inbound traffic control.
- E. Incorrect.
This is incorrect. Allowing inbound traffic from the internet directly to the private subnet on the database port violates the requirement to prevent direct internet access to the database servers.