SAP-C02 Question 60
Select 3A company is hosting a multi-tier web application in a VPC. The application has a public-facing load balancer in a public subnet, web servers in a private subnet, and backend databases in another private subnet. The web servers need to connect to the internet to download updates, but all other internet access should be restricted. Which combination of configurations will meet these requirements?
- A
Associate the private subnet containing the web servers with a route table that has a route to an internet gateway.
- B
Create a route table for the private subnet containing the web servers with a route to a NAT gateway in the public subnet.
- C
Configure the security group of the web servers to allow outbound traffic on ports 80 and 443.
- D
Configure the security group of the web servers to allow inbound traffic from the NAT gateway on ports 80 and 443.
- E
Configure a network ACL for the private subnet to allow outbound traffic on ports 80 and 443 and inbound ephemeral ports.
Show answer and explanation
Correct answers: B, C, E
Explanation
To meet the requirement of allowing the web servers in the private subnet to access the internet for updates while restricting all other internet access, you should use a NAT gateway and configure the route table, security group, and network ACL properly. The NAT gateway provides internet access for the private subnet without exposing resources to incoming internet traffic. Security groups and network ACLs are used to fine-tune traffic permissions for the application.
- A. Incorrect.
Incorrect. Associating the private subnet with a route table that has a route to an internet gateway would make the web servers directly accessible from the internet, which violates the requirement to restrict internet access.
- B. Correct.
Correct. A NAT gateway allows private subnets to access the internet for updates while ensuring that incoming traffic from the internet is not allowed.
- C. Correct.
Correct. Configuring the security group to allow outbound traffic on ports 80 and 443 enables the web servers to initiate connections to the internet for updates.
- D. Incorrect.
Incorrect. NAT gateways do not initiate inbound traffic to private subnets. Security groups should control outbound traffic from the web servers instead.
- E. Correct.
Correct. A network ACL should be configured to allow outbound traffic on ports 80 and 443 and ephemeral inbound ports to support return traffic from the internet.