SCS-C02 Question 205
Select 2Your company has deployed a web application running in an Amazon VPC. The application is fronted by an Application Load Balancer (ALB) and is accessible via HTTPS. The backend instances are in private subnets. To enhance security, you want to ensure that only traffic originating from the ALB can reach the backend instances. How can you achieve this goal?
- A
Configure a security group on the backend instances that only allows inbound traffic from the ALB's security group.
- B
Create a network ACL for the private subnets that allows inbound traffic only from the ALB's IP address range.
- C
Use an AWS WAF web ACL to restrict traffic to the ALB and backend instances.
- D
Enable VPC Flow Logs to monitor traffic to and from the backend instances.
- E
Modify the ALB's security group to allow only traffic destined for the backend instances' private IP addresses.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure that only traffic originating from the ALB can reach the backend instances, you need to implement both security group and network ACL rules. Security groups can be configured to allow traffic only from a specific source, such as the ALB's security group, while network ACLs can further restrict traffic at the subnet level based on IP ranges. These combined controls provide layered network security for the backend instances.
- A. Correct.
Correct. Security groups can reference other security groups. By configuring the backend instances' security group to allow traffic only from the ALB's security group, you ensure that only traffic originating from the ALB can reach the backend instances.
- B. Correct.
Correct. Network ACLs operate at the subnet level and can be used to allow or deny traffic based on IP ranges. By allowing traffic only from the ALB's IP address range, you can restrict access to the backend instances.
- C. Incorrect.
Incorrect. AWS WAF is designed to filter traffic at the ALB layer based on rules, but it cannot restrict traffic directly to the backend instances.
- D. Incorrect.
Incorrect. While VPC Flow Logs help monitor traffic, they do not actively restrict or control traffic.
- E. Incorrect.
Incorrect. Modifying the ALB's security group will not control traffic to the backend instances. Security group rules for the ALB govern inbound traffic to the ALB, not the backend instances.