SCS-C02 Question 200
Select 4You are designing a secure multi-tier web application architecture on AWS. The application consists of a public-facing web tier, an application tier for business logic, and a database tier. To comply with security best practices, which of the following configurations should you implement?
- A
Place the web tier in a public subnet and the application and database tiers in private subnets.
- B
Use security groups to allow traffic from the web tier to the application tier, and from the application tier to the database tier.
- C
Enable internet access for the database tier by assigning it a public IP address for maintenance purposes.
- D
Use Network ACLs to explicitly deny inbound traffic to the database tier from any source except the application tier.
- E
Deploy an Application Load Balancer (ALB) in front of the web tier to distribute traffic.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
A secure multi-tier web application architecture on AWS follows the principle of least privilege and implements multiple layers of security. Placing the web tier in a public subnet and the application/database tiers in private subnets isolates sensitive components. Security groups manage traffic flow between tiers, while Network ACLs provide an additional layer of security. An Application Load Balancer improves scalability and ensures secure traffic routing to the web tier. Publicly exposing the database tier is a security risk and should be avoided.
- A. Correct.
Correct. Placing the web tier in a public subnet and the application/database tiers in private subnets ensures that only the web tier is internet-facing, while the rest of the architecture remains isolated.
- B. Correct.
Correct. Security groups allow you to control traffic flow between tiers by permitting only necessary traffic, such as HTTP/HTTPS from the web tier to the application tier, and database queries from the application tier to the database tier.
- C. Incorrect.
Incorrect. Assigning a public IP address to the database tier introduces unnecessary risk by exposing the database to the internet, which violates security best practices.
- D. Correct.
Correct. Network ACLs can be used to add an additional layer of security by restricting traffic to the database tier to only originate from the application tier.
- E. Correct.
Correct. An ALB ensures secure and efficient traffic distribution to the web tier, and it also supports features like HTTPS termination for secure communication.