SCS-C02 Question 235
Select 3Your organization has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data, and the security team has mandated strict compliance with security standards. As a security engineer, you are tasked with designing and implementing security controls to ensure that the compute workloads are protected. Which of the following actions should you take to secure this environment?
- A
Enable encryption in transit by configuring HTTPS listeners on the ALB with a valid SSL/TLS certificate.
- B
Use EC2 instance profiles to assign IAM roles that restrict access to only the resources the application requires.
- C
Disable Amazon Inspector to avoid unnecessary resource usage and cost within the environment.
- D
Implement a security group that allows inbound traffic on ports 80 and 443 from any IP and restricts all outbound traffic.
- E
Enable AWS Systems Manager Session Manager for secure and auditable remote access to EC2 instances.
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure compute workloads in this scenario, several actions must be taken. Enabling HTTPS on the ALB ensures encryption in transit, protecting sensitive data. Assigning IAM roles to EC2 instances enforces least-privilege access, reducing the risk of resource compromise. Enabling AWS Systems Manager Session Manager provides secure and auditable management of EC2 instances without relying on SSH or open ports, enhancing security posture. Disabling security tools like Amazon Inspector or allowing overly permissive inbound traffic would compromise the environment's security and are therefore not recommended.
- A. Correct.
Correct. Enabling HTTPS on the Application Load Balancer ensures data is encrypted in transit, which is critical for protecting sensitive customer information.
- B. Correct.
Correct. Using IAM roles with EC2 instance profiles ensures the principle of least privilege is followed, minimizing the risk of unauthorized access to AWS resources.
- C. Incorrect.
Incorrect. Disabling Amazon Inspector would remove an important layer of security. Amazon Inspector helps identify vulnerabilities and deviations from best practices.
- D. Incorrect.
Incorrect. Allowing inbound traffic from any IP on ports 80 and 443 is not secure. Additionally, restricting all outbound traffic could disrupt legitimate application functionality.
- E. Correct.
Correct. AWS Systems Manager Session Manager provides secure, auditable access to EC2 instances without the need for SSH keys or open ports, enhancing security.