SCS-C02 Question 206
Single answerYour organization has deployed a web application on AWS using an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). Security policies require that only traffic from specific IP ranges can access the application, while all other traffic should be denied. How should you design and implement network security controls to meet this requirement?
- A
Configure an ALB listener rule to allow only the specific IP ranges and block all other traffic.
- B
Use a Network ACL on the subnets where the EC2 instances are deployed to allow the specific IP ranges and deny all other traffic.
- C
Create a security group for the ALB to allow inbound traffic only from the specific IP ranges.
- D
Enable AWS WAF on the ALB and create rules to allow the specific IP ranges and deny all other traffic.
Show answer and explanation
Correct answer: C
Explanation
The most appropriate solution is to use security groups attached to the ALB to define rules that allow inbound traffic only from the specific IP ranges. Security groups are stateful, simple to manage, and designed for controlling network access at the instance or service level. Other options, such as NACLs or AWS WAF, are either less precise, more complex, or not suitable for this specific requirement.
- A. Incorrect.
ALB listener rules cannot filter traffic based on IP addresses. Listener rules operate at the application layer (e.g., URLs or HTTP headers), not network layer IP filtering.
- B. Incorrect.
While Network ACLs (NACLs) can filter traffic based on IP ranges, they apply at the subnet level and are stateless. This would be harder to manage and less precise compared to security groups, which are stateful and operate at the instance level.
- C. Correct.
Security groups are stateful and allow precise control over inbound and outbound traffic. By attaching a security group to the ALB, you can define rules to allow only the specific IP ranges and deny all other traffic. This is the most appropriate and efficient solution in this scenario.
- D. Incorrect.
AWS WAF is used primarily for protecting web applications from common vulnerabilities (e.g., SQL injection, XSS), not for network-layer IP filtering. While it supports IP-based rules, it is more expensive and complex than using security groups for this purpose.