SCS-C02 Question 202
Select 3Your organization is designing a highly secure web application architecture on AWS. The architecture consists of three layers: web servers, application servers, and database servers. To minimize attack surfaces and enhance security, which actions should be taken to ensure a layered security approach for this web application?
- A
Place the web servers in a public subnet with direct internet access and restrict access to the application servers via security groups.
- B
Implement Application Load Balancers (ALBs) in front of the web servers to handle incoming traffic and terminate SSL/TLS connections.
- C
Deploy the application servers in a private subnet, ensuring only the web servers can communicate with them via security groups.
- D
Enable database servers to accept connections directly from the internet to allow remote administration.
- E
Use network ACLs and security groups together to restrict access to the database servers only from the application servers.
Show answer and explanation
Correct answers: B, C, E
Explanation
A layered security approach involves minimizing the attack surface and enforcing access controls at multiple layers of the architecture. Using an ALB for secure traffic handling, isolating the application and database servers in private subnets, and enforcing strict access controls through security groups and network ACLs are key components of a secure layered architecture. Avoid exposing resources like web servers or database servers directly to the internet unless absolutely necessary.
- A. Incorrect.
While restricting access to the application servers via security groups is a good practice, placing the web servers in a public subnet with direct internet access increases the attack surface. Instead, web traffic should be routed through a load balancer.
- B. Correct.
Using an Application Load Balancer (ALB) to handle incoming traffic and terminate SSL/TLS connections improves security by offloading encryption and ensuring secure communication with clients.
- C. Correct.
Deploying application servers in a private subnet and restricting access to them from only the web servers via security groups ensures that they are not directly accessible from the internet, reducing the attack surface.
- D. Incorrect.
Allowing database servers to accept direct connections from the internet is a major security risk. Database servers should always be isolated in private subnets with controlled access.
- E. Correct.
Using network ACLs and security groups together to restrict access to the database servers only from the application servers implements defense-in-depth and minimizes potential attack vectors.