SCS-C02 Question 212
Select 3Your organization has deployed a web application in a public subnet of a VPC. The application is accessible via HTTPS on port 443, and an Amazon RDS database is hosted in a private subnet. The security team has identified that unauthorized IP addresses are attempting to connect to the web application. Which combination of VPC security mechanisms can you use to mitigate this issue while ensuring valid traffic is not disrupted?
- A
Configure a security group on the EC2 instances to allow only specific IP addresses on port 443.
- B
Use a network ACL to explicitly deny traffic from the unauthorized IP addresses.
- C
Deploy an AWS Network Firewall to block traffic from unauthorized IP ranges.
- D
Remove the internet gateway from the VPC to block all external traffic.
- E
Modify the RDS security group to allow connections only from the web application instances.
Show answer and explanation
Correct answers: A, B, C
Explanation
To mitigate unauthorized access to the web application, a combination of multiple VPC security mechanisms is recommended. Security groups allow you to control traffic at the instance level, network ACLs provide subnet-level filtering, and AWS Network Firewall can enforce more complex rules to block unauthorized IP ranges. Removing the internet gateway is not viable as it would block legitimate traffic, and modifying the RDS security group does not address the web application’s security.
- A. Correct.
This is a valid approach. Security groups operate at the instance level and can be used to allow or deny specific IP addresses or ranges. Restricting access to only known IPs ensures unauthorized access is mitigated.
- B. Correct.
This is a valid approach. Network ACLs operate at the subnet level and can explicitly deny traffic from unauthorized IP addresses, providing an additional layer of security.
- C. Correct.
This is a valid approach. AWS Network Firewall can be used to implement granular filtering rules and block traffic from unauthorized IP ranges or malicious sources.
- D. Incorrect.
This is not a valid approach. Removing the internet gateway would block all external traffic, including valid user traffic, making the application inaccessible to legitimate users.
- E. Incorrect.
This is not relevant to the scenario. Modifying the RDS security group protects the database but does not address the unauthorized access issue for the web application.