SCS-C02 Question 215
Select 3Your company is hosting a three-tier web application in AWS. The application consists of web servers, application servers, and a backend database hosted in a private subnet. You need to ensure that the following security requirements are met:
- The web servers should only accept HTTP and HTTPS traffic from the internet.
- The application servers should only accept traffic from the web servers on port 8080.
- The database should only accept traffic from the application servers on port 3306.
- All other traffic should be denied.
Which combination of actions should you take to meet these requirements?
- A
Create a security group for the web servers allowing inbound HTTP and HTTPS traffic from 0.0.0.0/0 and attach it to the web servers.
- B
Create a security group for the application servers allowing inbound traffic from the web server security group on port 8080 and attach it to the application servers.
- C
Create a network ACL on the public subnet to allow inbound HTTP and HTTPS traffic from 0.0.0.0/0 and outbound traffic to the application servers on port 8080.
- D
Create a security group for the database allowing inbound traffic from the application server security group on port 3306 and attach it to the database.
- E
Create a network ACL on the private subnet to allow inbound traffic on port 3306 from the application servers and attach it to the subnet.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure a three-tier architecture, security groups should be used to control traffic between tiers at the instance level. Network ACLs are subnet-level controls and are not required in this scenario since security group rules can effectively enforce the necessary restrictions.
- A. Correct.
Correct. A security group for the web servers should allow inbound HTTP (port 80) and HTTPS (port 443) traffic from any source (0.0.0.0/0) to make the web servers accessible from the internet.
- B. Correct.
Correct. The application servers' security group must allow inbound traffic from the web servers' security group on port 8080 to handle application-level traffic securely.
- C. Incorrect.
Incorrect. Network ACLs are optional for this scenario, and using a security group to control traffic between the web and application servers is sufficient.
- D. Correct.
Correct. The database's security group should allow inbound traffic on port 3306 from the application servers' security group to enable database communication securely.
- E. Incorrect.
Incorrect. Using a network ACL for controlling database traffic is unnecessary because the security group attached to the database is sufficient to enforce the rule.