SCS-C02 Question 234
Select 2Your organization is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). To adhere to security best practices, you need to ensure that only encrypted traffic is allowed to the instances and that unauthorized access attempts are blocked. What combination of security controls should you implement?
- A
Configure the ALB to terminate HTTPS and forward traffic to EC2 instances over HTTP.
- B
Set up a security group for the EC2 instances allowing only traffic from the ALB on a custom port.
- C
Use an ACM-managed TLS certificate on the ALB to enable HTTPS for incoming connections.
- D
Implement Network ACLs that deny all traffic except HTTPS traffic to the EC2 instances.
- E
Configure the EC2 instances to terminate HTTPS and install a TLS certificate on each instance.
Show answer and explanation
Correct answers: B, C
Explanation
To secure compute workloads, it's essential to terminate HTTPS at the ALB using an ACM-managed TLS certificate and ensure only trusted traffic reaches the EC2 instances. Configuring a security group to allow traffic only from the ALB provides an additional layer of security. This approach simplifies management and ensures compliance with encryption requirements.
- A. Incorrect.
This is incorrect because forwarding traffic from the ALB to the EC2 instances over HTTP would expose the instances to insecure communication and potential attacks.
- B. Correct.
This is correct because security groups can be used to restrict access to the EC2 instances, ensuring only traffic from the ALB is permitted.
- C. Correct.
This is correct because using an ACM-managed TLS certificate on the ALB ensures that incoming traffic is encrypted, adhering to security best practices.
- D. Incorrect.
This is incorrect because Network ACLs cannot enforce HTTPS-specific rules and are not the best tool for fine-grained traffic control to EC2 instances behind an ALB.
- E. Incorrect.
This is incorrect because terminating HTTPS at the EC2 instances increases complexity and management overhead, especially when scaling the application. It's more efficient to terminate HTTPS at the ALB.