SCS-C02 Question 207
Select 2Your company has deployed a multi-tier web application on AWS using an Elastic Load Balancer (ELB), a fleet of EC2 instances in an Auto Scaling group in a public subnet, and a backend database hosted in an RDS instance in a private subnet. As a security engineer, you are tasked with designing and implementing network security controls to ensure the following: 1) The database can only be accessed by the application servers, 2) The application servers can only receive traffic from the ELB, and 3) Internet traffic is blocked from directly accessing the database. Which of the following network security configurations should you implement?
- A
Configure the security group of the RDS instance to allow inbound traffic only from the security group of the EC2 instances.
- B
Configure the security group of the EC2 instances to allow inbound traffic only from the security group of the ELB.
- C
Attach a Network ACL to the public subnet to block inbound traffic to the RDS instance's IP address.
- D
Configure the security group of the ELB to allow inbound HTTP and HTTPS traffic from any source and restrict outbound traffic to the security group of the EC2 instances.
- E
Add an inbound rule in the RDS instance's security group to allow traffic from 0.0.0.0/0 on port 3306.
Show answer and explanation
Correct answers: A, B
Explanation
To design effective network security controls, it's essential to use security groups to restrict access at the resource level. By configuring the RDS instance's security group to allow only the EC2 instances' security group and the EC2 instances' security group to allow only the ELB's security group, you can enforce least privilege access. This approach ensures that the database is securely isolated, the application servers only accept traffic from the intended source (ELB), and no unauthorized public access is allowed.
- A. Correct.
Correct. This ensures that only the application servers (EC2 instances) can access the database, meeting the requirement that the database is not exposed to the public.
- B. Correct.
Correct. This ensures that the application servers only receive traffic from the ELB, which is an essential security control to prevent unauthorized access.
- C. Incorrect.
Incorrect. Network ACLs can provide subnet-level control, but this option incorrectly suggests blocking traffic to the RDS instance's IP address, which is not the best practice for this scenario. Security groups are more appropriate for resource-specific controls.
- D. Incorrect.
Incorrect. While allowing inbound traffic from any source to the ELB security group is correct for a public-facing application, restricting outbound traffic from the ELB to the EC2 instances' security group is unnecessary, as ELBs do not need such outbound rules.
- E. Incorrect.
Incorrect. Allowing traffic from 0.0.0.0/0 on port 3306 to the RDS instance would expose the database to the public internet, which violates the security requirements.