SCS-C02 Question 214
Select 3An organization has deployed an application in a VPC with private and public subnets. The application servers are in the private subnet, and a Network Load Balancer (NLB) in the public subnet handles external traffic. The organization wants to ensure that only traffic from a specific range of trusted IP addresses can access the application servers. Which of the following actions should be taken to meet this requirement?
- A
Configure a security group for the application servers to allow inbound traffic only from the trusted IP address range.
- B
Create a network ACL for the private subnet to allow inbound traffic only from the trusted IP address range.
- C
Attach an AWS Network Firewall to the VPC and configure stateful rules to allow traffic only from the trusted IP address range.
- D
Configure the NLB's security group to restrict inbound traffic to the trusted IP address range.
- E
Use an Application Load Balancer instead of a Network Load Balancer to enforce the IP address restriction.
Show answer and explanation
Correct answers: A, B, C
Explanation
To restrict access to the application servers from a specific range of trusted IP addresses, security groups, network ACLs, or AWS Network Firewall can be used. Security groups provide instance-level protection, network ACLs operate at the subnet level, and AWS Network Firewall provides VPC-wide stateful filtering. NLBs do not support security groups, and switching to an ALB does not inherently solve the problem without additional security configurations.
- A. Correct.
Correct. Security groups operate as virtual firewalls for instances and can be used to allow inbound traffic only from the trusted IP address range.
- B. Correct.
Correct. Network ACLs operate at the subnet level and can be used to restrict traffic to the private subnet from the trusted IP address range.
- C. Correct.
Correct. AWS Network Firewall can enforce stateful rules at the VPC level to restrict traffic to the trusted IP address range.
- D. Incorrect.
Incorrect. NLBs do not have security groups. Security restrictions must be enforced using other mechanisms like security groups, network ACLs, or AWS Network Firewall.
- E. Incorrect.
Incorrect. Changing the load balancer type to an Application Load Balancer would not inherently enforce IP address restrictions. The restriction should be applied via security mechanisms like security groups, network ACLs, or AWS Network Firewall.