SCS-C02 Question 201
Select 4You are designing a secure and scalable web application on AWS using a layered architecture. The application has a public-facing frontend, a backend API, and a database layer. To minimize exposure to potential attacks, which combination of security measures should you implement?
- A
Deploy the frontend in an Amazon S3 bucket configured with static website hosting and restrict access using an Amazon CloudFront distribution.
- B
Place the backend API behind an Application Load Balancer (ALB) and secure it using AWS WAF to filter malicious traffic.
- C
Host the database in a public subnet with security groups allowing traffic from any source to ensure accessibility.
- D
Use Amazon RDS with private subnets and enable encryption at rest and in transit.
- E
Implement security group rules to allow traffic between application layers only from specific allowed sources.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
A layered web application architecture on AWS should follow the principle of least privilege, minimizing exposure to potential threats and ensuring secure communication between layers. Hosting the frontend securely, restricting backend access with WAF, encrypting the database, and implementing strict security group rules are all critical measures in achieving this. Placing the database in a public subnet is a security risk and goes against best practices, making it an incorrect choice.
- A. Correct.
Deploying the frontend in an Amazon S3 bucket with CloudFront ensures a secure and scalable delivery mechanism, while restricting direct access to the S3 bucket reduces exposure to attacks. This is a best practice for static content hosting.
- B. Correct.
Placing the backend API behind an ALB and securing it with AWS WAF helps to filter and block malicious traffic such as SQL injection or cross-site scripting (XSS), improving overall application security.
- C. Incorrect.
Hosting the database in a public subnet with open access is a poor security practice as it exposes the database to potential attacks from the internet. Databases should always be in private subnets with restricted access.
- D. Correct.
Using Amazon RDS with private subnets and enabling encryption ensures that the database is not directly accessible from the internet and that data is encrypted both at rest and in transit, following security best practices.
- E. Correct.
Implementing security group rules to allow traffic only from specific allowed sources minimizes the attack surface between application layers, ensuring that traffic is controlled and restricted to what is necessary.