SCS-C02 Question 204
Select 3Your organization has deployed a three-tier architecture on AWS, consisting of a public-facing web tier in an Application Load Balancer (ALB), an application tier in private subnets, and a database tier in private subnets. The architecture must ensure that only the web tier can be accessed from the internet, and all communication between the tiers must be restricted to specific ports. Which combination of network security controls should you implement to meet these requirements?
- A
Configure a security group for the ALB to allow inbound traffic only from the internet on ports 80 and 443.
- B
Set up a Network ACL on the private subnets to allow traffic from the public subnets on ports 80 and 443 only.
- C
Configure a security group for the application servers to allow traffic only from the ALB's security group on port 443.
- D
Apply a security group to the database tier to allow traffic only from the application servers' security group on the database port.
- E
Configure the ALB to use an Elastic IP and whitelist the organization's IP range to restrict access.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the requirements, you must use security groups to restrict traffic between the tiers to specific sources and ports. The ALB security group allows traffic from the internet on ports 80 and 443, the application servers' security group restricts traffic to the ALB on port 443, and the database tier security group restricts traffic to the application servers on the database port. Network ACLs and Elastic IP configurations are either unnecessary or less suitable for this use case.
- A. Correct.
Correct. The security group for the ALB ensures that only traffic from the internet on ports 80 (HTTP) and 443 (HTTPS) is allowed, aligning with the requirement to restrict access to the web tier.
- B. Incorrect.
Incorrect. Network ACLs are stateless and less granular compared to security groups. Security groups are more appropriate for restricting communication between tiers in this scenario.
- C. Correct.
Correct. By configuring the application servers' security group to accept traffic only from the ALB's security group on port 443, you ensure secure communication between the web and application tiers.
- D. Correct.
Correct. Applying a security group to the database tier that allows traffic only from the application servers' security group on the specific database port ensures secure and restricted communication between the application and database tiers.
- E. Incorrect.
Incorrect. While using an Elastic IP and whitelisting the organization's IP range might restrict access, it is not part of the requirements to restrict access to the web tier based on IP. The ALB's security group fulfills this purpose.