SCS-C02 Question 182
Single answerAn organization is hosting a multi-tier web application in AWS. The application consists of public-facing web servers in an Auto Scaling group behind an Application Load Balancer (ALB), private application servers, and a backend Amazon RDS database. The organization wants to ensure that only the web servers can access the application servers while maintaining security best practices. How should the organization configure its infrastructure to meet this requirement?
- A
Use security groups to allow traffic from the web servers' security group to the application servers' security group.
- B
Use Network Access Control Lists (NACLs) to allow traffic from the web servers' private IP ranges to the application servers.
- C
Attach the web servers and application servers to the same security group to allow unrestricted communication.
- D
Use an AWS WAF to block all traffic except from the web servers to the application servers.
Show answer and explanation
Correct answer: A
Explanation
The best practice for controlling traffic between tiers in an AWS environment is to use security groups. Security groups are stateful and allow you to reference other security groups, enabling precise control of traffic while adhering to the principle of least privilege. In this case, a security group on the application servers can be configured to allow inbound traffic only from the security group attached to the web servers.
- A. Correct.
This is the correct answer. Security groups are stateful and can be used to allow specific traffic between resources by referencing other security groups. This is a best practice in AWS.
- B. Incorrect.
While NACLs can be used to restrict traffic, they are stateless and less flexible compared to security groups. This approach is not the most secure or efficient method for this scenario.
- C. Incorrect.
Attaching both tiers to the same security group would allow unrestricted communication between them, violating the principle of least privilege.
- D. Incorrect.
AWS WAF is used to protect web applications from common web exploits and does not control traffic between EC2 instances or application tiers.