SCS-C02 Question 181
Select 3Your organization has deployed a web application on Amazon EC2 instances in a public subnet. To enhance security, you need to ensure that only HTTPS traffic is allowed to the EC2 instances, SSH access is restricted to a specific IP address, and all other traffic is denied. Which of the following actions should you take to meet these requirements?
- A
Create a security group that allows inbound traffic on port 443 from 0.0.0.0/0.
- B
Create a security group that allows inbound traffic on port 22 only from the organization's specific IP address.
- C
Configure the Network Access Control List (NACL) to allow inbound and outbound traffic on port 443.
- D
Configure the Network Access Control List (NACL) to explicitly deny all inbound traffic on port 22 except from the organization's specific IP address.
- E
Set the security group's outbound rules to deny all traffic except HTTPS.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the security requirements, you need to configure both security groups and NACLs effectively. Security groups should allow HTTPS traffic (port 443) for the web application and restrict SSH access (port 22) to a specific IP address. NACLs should complement security groups by allowing inbound and outbound HTTPS traffic but do not support the granular restriction of SSH access based on IP addresses. Outbound traffic from security groups does not need to be restricted unless explicitly required, as AWS security groups are stateful.
- A. Correct.
Correct. A security group that allows inbound traffic on port 443 (HTTPS) from 0.0.0.0/0 ensures that the web application is accessible to users over HTTPS.
- B. Correct.
Correct. Restricting SSH access to the organization's specific IP address increases security by limiting administrative access to trusted sources.
- C. Correct.
Correct. In addition to security groups, NACLs should allow inbound and outbound HTTPS traffic to support the web application's functionality.
- D. Incorrect.
Incorrect. NACLs cannot be configured to allow traffic only from specific IPs for a single port. Such granular control is better managed through security groups.
- E. Incorrect.
Incorrect. Security group's outbound rules should generally allow all traffic unless there is a specific reason to restrict outbound communication. HTTPS traffic would already be implicitly allowed by default.